Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 19:01
Behavioral task
behavioral1
Sample
d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe
Resource
win7-20220901-en
General
-
Target
d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe
-
Size
287KB
-
MD5
83bce18881b9fe592e679d2ea6a09de3
-
SHA1
786a43df4319c1e2611768c69733af4017c4283f
-
SHA256
d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd
-
SHA512
f9aa80579cbd742ec7d09e920ac34086530f0fc22cdabf51448d421a732a8a5a1db814e48ddbe902a871c05ca600c5e4704a7c632a392f15f10bf124056515b3
-
SSDEEP
6144:lk4qmIBv6YqEzG7xtfo5cMMvdaGZFp4C5JjyoiEJ8X0:i9PBixyDMpDpTJWeJ8
Malware Config
Extracted
cybergate
2.6
vítima
127.0.0.1:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
system31
-
install_file
rundll32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system31\\rundll32.exe" d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system31\\rundll32.exe" d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Executes dropped EXE 1 IoCs
pid Process 628 rundll32.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system31\\rundll32.exe Restart" d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system31\\rundll32.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
resource yara_rule behavioral1/memory/1444-55-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1444-57-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1444-66-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/572-71-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/572-72-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x000b000000012301-74.dat upx behavioral1/memory/1444-76-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1108-83-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1444-84-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1444-90-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1108-89-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/files/0x000b000000012301-135.dat upx behavioral1/memory/572-136-0x00000000318E0000-0x00000000318ED000-memory.dmp upx behavioral1/memory/1108-137-0x0000000005270000-0x00000000052CC000-memory.dmp upx behavioral1/memory/1108-140-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/files/0x000b000000012301-138.dat upx behavioral1/files/0x000b000000012301-141.dat upx behavioral1/memory/628-147-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/628-148-0x0000000031900000-0x000000003190D000-memory.dmp upx behavioral1/memory/628-149-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/628-150-0x0000000031900000-0x000000003190D000-memory.dmp upx behavioral1/memory/572-151-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/572-153-0x00000000318E0000-0x00000000318ED000-memory.dmp upx behavioral1/memory/1108-154-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system31\\rundll32.exe" d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system31\\rundll32.exe" d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\system31\rundll32.exe d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe File opened for modification C:\Windows\system31\rundll32.exe d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe File opened for modification C:\Windows\system31\rundll32.exe d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe File opened for modification C:\Windows\system31\ d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe Token: SeDebugPrivilege 1108 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15 PID 1444 wrote to memory of 1344 1444 d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe 15
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:300
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1580
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1476
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1200
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1040
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:288
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:828
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:744
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:480
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe"C:\Users\Admin\AppData\Local\Temp\d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
PID:572
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:728
-
-
C:\Users\Admin\AppData\Local\Temp\d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe"C:\Users\Admin\AppData\Local\Temp\d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd.exe"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\system31\rundll32.exe"C:\Windows\system31\rundll32.exe"4⤵
- Executes dropped EXE
PID:628
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD58aaa70915e90eb3b7b9a0d29f85b936b
SHA17c24d95b3614ab0b31826fa1f4dafb6e4c003851
SHA256b8575769b71be6f6640ae58188fbc8282e21ba1a008040c27122890d00feb154
SHA512a11398b25e1388af51e57ae4a0980329bd060b87bfa301f0424ee003ef63d0bd629c4b5b4f72e0907745920fc0775a87ea0350058d066e09f0efd5e9651e89c5
-
Filesize
287KB
MD583bce18881b9fe592e679d2ea6a09de3
SHA1786a43df4319c1e2611768c69733af4017c4283f
SHA256d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd
SHA512f9aa80579cbd742ec7d09e920ac34086530f0fc22cdabf51448d421a732a8a5a1db814e48ddbe902a871c05ca600c5e4704a7c632a392f15f10bf124056515b3
-
Filesize
287KB
MD583bce18881b9fe592e679d2ea6a09de3
SHA1786a43df4319c1e2611768c69733af4017c4283f
SHA256d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd
SHA512f9aa80579cbd742ec7d09e920ac34086530f0fc22cdabf51448d421a732a8a5a1db814e48ddbe902a871c05ca600c5e4704a7c632a392f15f10bf124056515b3
-
Filesize
287KB
MD583bce18881b9fe592e679d2ea6a09de3
SHA1786a43df4319c1e2611768c69733af4017c4283f
SHA256d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd
SHA512f9aa80579cbd742ec7d09e920ac34086530f0fc22cdabf51448d421a732a8a5a1db814e48ddbe902a871c05ca600c5e4704a7c632a392f15f10bf124056515b3
-
Filesize
287KB
MD583bce18881b9fe592e679d2ea6a09de3
SHA1786a43df4319c1e2611768c69733af4017c4283f
SHA256d30bb80f4b01bf6aebec3ccee4d67cb0bca9d805037bcd5ffe6fc33c3a00e7dd
SHA512f9aa80579cbd742ec7d09e920ac34086530f0fc22cdabf51448d421a732a8a5a1db814e48ddbe902a871c05ca600c5e4704a7c632a392f15f10bf124056515b3