Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 09:59
Behavioral task
behavioral1
Sample
f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe
Resource
win7-20220901-en
General
-
Target
f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe
-
Size
284KB
-
MD5
971142f4e5dd21bba14beab50a8325d0
-
SHA1
c853ec77f626109a56118ae1b1d029d5105a1b90
-
SHA256
f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3
-
SHA512
c5dd87738b1957a602793f7602552f573e73f2d2811729e1c69e5b7a2d2821e72816bca80c6fe8941e5cbd884f8013bf006beaf6cedb5aa7368a8876f49007f8
-
SSDEEP
6144:ak4qmNLtDfU3Ny5zEVwM4HCvVUAb2bKQ7kTpYdDh8:F9CfIN0tMXV4KC
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
tebib1984.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
Win_Xp.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Please try again later.
-
message_box_title
Error
-
password
123456
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4956 created 872 4956 WerFault.exe 82 -
Executes dropped EXE 1 IoCs
pid Process 872 Win_Xp.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe Restart" f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe" f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe -
resource yara_rule behavioral2/memory/2888-132-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/2888-134-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/2888-139-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/2888-140-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4564-143-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4564-144-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2888-146-0x0000000002410000-0x0000000002472000-memory.dmp upx behavioral2/memory/3968-151-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/2888-152-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3968-155-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/2888-156-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/3968-157-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/files/0x0009000000022f6d-159.dat upx behavioral2/memory/3968-160-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx behavioral2/files/0x0009000000022f6d-162.dat upx behavioral2/memory/872-163-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/4956-164-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/872-165-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/872-166-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/4956-167-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/4956-168-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/312-169-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/3564-170-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx behavioral2/memory/312-171-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/3564-172-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx behavioral2/memory/4564-173-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3564-174-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx behavioral2/memory/872-175-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/3968-176-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3968-177-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe File opened for modification \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe explorer.exe File opened for modification \??\c:\windows\SysWOW64\microsoft\ explorer.exe File created \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 312 872 WerFault.exe 82 3564 312 WerFault.exe 85 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe 4564 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4564 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4564 explorer.exe Token: SeDebugPrivilege 4564 explorer.exe Token: SeRestorePrivilege 3564 WerFault.exe Token: SeBackupPrivilege 3564 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45 PID 2888 wrote to memory of 760 2888 f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe 45
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:680
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:804
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:664
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1200
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1876
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2524
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2592
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3200
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:776
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:4584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:4532
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4680
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4800
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2816
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3548
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3400
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3092
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe"C:\Users\Admin\AppData\Local\Temp\f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\windows\SysWOW64\microsoft\Win_Xp.exe"C:\windows\system32\microsoft\Win_Xp.exe"4⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 5645⤵
- Program crash
PID:312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 6246⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3564
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe"C:\Users\Admin\AppData\Local\Temp\f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3.exe"3⤵
- Modifies Installed Components in the registry
PID:3968
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2668
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2368
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2120
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:1444
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1900
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1344
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:912
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:788
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:3140
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:1744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 8722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 312 -ip 3122⤵PID:748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3564 -ip 35642⤵PID:1480
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:2660
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:2824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4252
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5a0b35ea56bffbdce3b73023ee432d11a
SHA12ae46f988d489e5ce40194be20ddd63377014e3b
SHA25663723bf41e62be10d779690b2214b442ef8c4adb1c5e1ca4608f802e835f7275
SHA51282b5a6ecdc76244c53df1059a3b82e98ad874a44c1b5927ddd24a834e5b0430ce67138ebaa1e40304e83f2ddcc6303da2cb9595a4eee70117bd0a0fa4a26ff70
-
Filesize
284KB
MD5971142f4e5dd21bba14beab50a8325d0
SHA1c853ec77f626109a56118ae1b1d029d5105a1b90
SHA256f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3
SHA512c5dd87738b1957a602793f7602552f573e73f2d2811729e1c69e5b7a2d2821e72816bca80c6fe8941e5cbd884f8013bf006beaf6cedb5aa7368a8876f49007f8
-
Filesize
284KB
MD5971142f4e5dd21bba14beab50a8325d0
SHA1c853ec77f626109a56118ae1b1d029d5105a1b90
SHA256f4b3b7bbb1b9cbeb037cf4b48f32ee23d09c023d65ff03ac6edd118c562a92d3
SHA512c5dd87738b1957a602793f7602552f573e73f2d2811729e1c69e5b7a2d2821e72816bca80c6fe8941e5cbd884f8013bf006beaf6cedb5aa7368a8876f49007f8