Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Resource
win10v2004-20220812-en
General
-
Target
2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
-
Size
371KB
-
MD5
0e2c1780f99d1c57f78f0484a173ec54
-
SHA1
4d423db7595080e1a080145a642c1321720fb70a
-
SHA256
2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f
-
SHA512
60e109ef8b41429d191115bb36ffc09267d3e6b0664d5ebe4320b1b11548c5c2d4fdffb52906ba9d3a65d162b8f7800155df91d95bc360e93aeafacd7edae774
-
SSDEEP
6144:XyH7xOc6H5c6HcT66vlmNxkpGYT6ZgWy5Rwj4Rg4jJusNnhEkcOw1KJjamBUd9OY:XaJJUy5RwjA/jgknhEklJvBzKH3
Malware Config
Extracted
cybergate
2.6
XAT INFECT
xatkomokonline.no-ip.biz:88
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
matheuscs
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Executes dropped EXE 7 IoCs
pid Process 4312 svchost.exe 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 3932 svchost.exe 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 4956 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 3872 server.exe 3576 server.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
resource yara_rule behavioral2/memory/2096-142-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2096-145-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2096-146-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2096-147-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2096-149-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/2096-154-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4600-157-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4600-160-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2096-162-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/2096-168-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/4956-171-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/2096-172-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4956-173-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3576-182-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3576-183-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3576-184-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4956-185-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\install\server.exe 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe File opened for modification C:\Windows\SysWOW64\install\ 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2084 set thread context of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 3872 set thread context of 3576 3872 server.exe 87 -
Drops file in Program Files directory 38 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4068 3576 WerFault.exe 87 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4956 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4956 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe Token: SeDebugPrivilege 4956 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 3872 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 4312 1560 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 78 PID 1560 wrote to memory of 4312 1560 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 78 PID 1560 wrote to memory of 4312 1560 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 78 PID 4312 wrote to memory of 2084 4312 svchost.exe 79 PID 4312 wrote to memory of 2084 4312 svchost.exe 79 PID 4312 wrote to memory of 2084 4312 svchost.exe 79 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2084 wrote to memory of 2096 2084 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 81 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47 PID 2096 wrote to memory of 2616 2096 2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exeC:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Modifies Installed Components in the registry
PID:4600
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3872 -
C:\Windows\SysWOW64\install\server.exeC:\Windows\SysWOW64\install\server.exe8⤵
- Executes dropped EXE
PID:3576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 5649⤵
- Program crash
PID:4068
-
-
-
-
-
-
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3576 -ip 35761⤵PID:1544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Filesize336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Filesize336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Filesize336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
Filesize336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
Filesize
229KB
MD503515d22ecfc29db74f6300c38317a29
SHA184c35b02f1ea626142ecf1019f1b0a3e190b4538
SHA256d6ad2c9e30ee5caa0b4a0660084c72a337136a565834b3ba8f10b194d6a2b3b4
SHA512f2d2fbab01a0caf09bf0f36eeda3ba8a8336f287318db439f1a0426b97c59682d8eb9c46f9b5b9be1c79acd0b07b0d066c1bbaf8de79be687e7e62971bf9833a
-
Filesize
336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
Filesize
336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
Filesize
336KB
MD5e3ae5ccc41b447e453e93377555d8bd9
SHA1bda69338afb715f38e3d1f6770bbc27647f72ee7
SHA2561b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f
SHA5120371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b