Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe
-
Size
404KB
-
MD5
839c1e421864a090c847647efe36c820
-
SHA1
8b65f5f322e96ce2a9b05edf151bebe901761320
-
SHA256
a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d
-
SHA512
86b22a1ec45d9f96855f296417e655f3686843114868b1882106e94cd055937fff0948c8f1ce236e08792b45550542a690369ae3eb8f002e110823cff522933a
-
SSDEEP
6144:zXC4vgmhbIxs3NBBuXTcYHERV2Qnqj3Zw3jzUaSErCn04VT0o7ObkVqE2JiFjrhl:zXCNi9BokRV2Q0p+4ajrCn0aOYbZhl
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\P: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\Q: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\X: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\Z: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\F: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\J: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\L: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\M: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\O: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\S: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\Y: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\B: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\G: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\U: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\V: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\W: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\A: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\E: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\H: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\K: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\N: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\R: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File opened (read-only) \??\T: a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\animal fetish hidden young (Gina).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\cumshot masturbation fishy .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\System32\DriverStore\Temp\fetish lesbian [free] hole .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\FxsTmp\handjob [milf] swallow .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\japanese cum several models (Christine,Anniston).avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\config\systemprofile\spanish animal sperm several models nipples .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\FxsTmp\spanish sperm xxx several models legs redhair .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\config\systemprofile\british gay nude sleeping redhair .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\IME\SHARED\lingerie licking .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black trambling action public ash (Samantha,Christine).avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\danish beastiality nude full movie hole .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\horse nude full movie .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\french lingerie horse sleeping penetration (Gina).mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\trambling public (Sarah,Britney).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Google\Update\Download\bukkake [free] vagina mistress .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Microsoft\Temp\gay uncut legs .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Common Files\microsoft shared\indian kicking licking circumcision (Tatjana,Tatjana).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\spanish blowjob hot (!) (Anniston).mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american handjob bukkake uncut .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\asian xxx beast big bondage .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Google\Temp\gay handjob lesbian redhair (Sandy).zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\african hardcore trambling hot (!) sm .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\Updates\Download\chinese porn sleeping redhair .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\xxx beast masturbation black hairunshaved (Liz).zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\norwegian lesbian public (Jade,Janette).rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\danish fucking [milf] gorgeoushorny .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian porn uncut cock ash .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british action kicking several models gorgeoushorny .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\sperm horse big high heels .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse big hairy .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse fetish uncut vagina stockings (Sonja).avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\gay catfight feet (Jade).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\CbsTemp\russian action big nipples .rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian fetish beastiality [milf] feet shower (Curtney,Jade).rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\action licking ΋ (Anniston,Ashley).rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\horse uncut castration (Tatjana).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\tmp\asian horse full movie hole .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\Downloaded Program Files\japanese horse masturbation ejaculation (Samantha,Liz).zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\InputMethod\SHARED\spanish porn catfight titts castration .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\blowjob full movie .rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\spanish gay beastiality licking .rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese action [milf] leather .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\kicking girls titts traffic (Ashley,Melissa).rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\security\templates\sperm kicking several models vagina penetration .zip.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\hardcore action sleeping traffic .mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\temp\chinese lingerie gang bang catfight .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fetish nude big .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\sperm sperm uncut circumcision .rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\mssrv.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\cum licking fishy (Sonja,Melissa).rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\beastiality fucking [bangbus] .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\PLA\Templates\lingerie fucking masturbation ejaculation (Samantha,Gina).mpg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\lesbian [free] feet pregnant .rar.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\german bukkake blowjob uncut lady .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\bukkake several models .avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\SoftwareDistribution\Download\animal licking shoes (Liz,Samantha).avi.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\handjob fetish hidden .mpeg.exe a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 4800 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 1260 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4212 wrote to memory of 2284 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 82 PID 4212 wrote to memory of 2284 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 82 PID 4212 wrote to memory of 2284 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 82 PID 4212 wrote to memory of 1260 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 83 PID 4212 wrote to memory of 1260 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 83 PID 4212 wrote to memory of 1260 4212 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 83 PID 2284 wrote to memory of 4800 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 84 PID 2284 wrote to memory of 4800 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 84 PID 2284 wrote to memory of 4800 2284 a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
-
C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"C:\Users\Admin\AppData\Local\Temp\a37a5258408b2bcd28a5fccb62939d1d5aeb841b0d67bfd1880cfe17666cb35d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260
-