Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe
Resource
win7-20220812-en
General
-
Target
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe
-
Size
637KB
-
MD5
0b16cabd2d4409e7fe84175dc5ab815a
-
SHA1
9bf32be127ab5c6a8c49435be5c6e17e984d01ef
-
SHA256
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
-
SHA512
9d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
SSDEEP
12288:6E4OUI9+3x/RqF/+IvciVbKJoTGB8aVUOKc77q15E3e:6EaI9+3xMFmQlVb6iaVUOKc3mJ
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
kyfen.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\windows.exe" 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\windows.exe" 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Executes dropped EXE 4 IoCs
pid Process 1328 windows.exe 4992 windows.exe 2440 windows.exe 4532 windows.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T0OM8Y32-MD33-3374-76XG-EKB1Q512V5WC} 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T0OM8Y32-MD33-3374-76XG-EKB1Q512V5WC}\StubPath = "C:\\Windows\\windows.exe Restart" 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T0OM8Y32-MD33-3374-76XG-EKB1Q512V5WC} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T0OM8Y32-MD33-3374-76XG-EKB1Q512V5WC}\StubPath = "C:\\Windows\\windows.exe" explorer.exe -
resource yara_rule behavioral2/memory/4224-146-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/4224-153-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1216-156-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1216-157-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4224-162-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/1080-165-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/1080-167-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/1328-171-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx behavioral2/memory/4992-174-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/1216-175-0x0000000031B70000-0x0000000031B7D000-memory.dmp upx behavioral2/memory/1328-176-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx behavioral2/memory/4992-177-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/1216-181-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2440-188-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/2440-192-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/4992-193-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/1080-196-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/1216-198-0x0000000031B70000-0x0000000031B7D000-memory.dmp upx behavioral2/memory/1328-199-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx behavioral2/memory/2440-201-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/1328-209-0x0000000031B80000-0x0000000031B8D000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\windows.exe" 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\windows.exe" 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2536 set thread context of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 4992 set thread context of 2440 4992 windows.exe 85 PID 1328 set thread context of 4532 1328 windows.exe 86 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\windows.exe 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe File opened for modification C:\Windows\windows.exe 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe File opened for modification C:\Windows\windows.exe 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe File opened for modification C:\Windows\ 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2388 4532 WerFault.exe 86 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe Token: SeDebugPrivilege 1080 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 4992 windows.exe 1328 windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 2536 wrote to memory of 4224 2536 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 78 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31 PID 4224 wrote to memory of 2596 4224 09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe 31
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:776
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:312
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3472
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3440
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3568
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3368
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3256
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3768
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4724
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2968
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:680
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:4020
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1436
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1320
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2516
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:944
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe"C:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exeC:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
PID:1216 -
C:\Windows\windows.exe"C:\Windows\windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1328 -
C:\Windows\windows.exeC:\Windows\windows.exe6⤵
- Executes dropped EXE
PID:4532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 887⤵
- Program crash
PID:2388
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe"C:\Users\Admin\AppData\Local\Temp\09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe"4⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\Windows\windows.exe"C:\Windows\windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4992 -
C:\Windows\windows.exeC:\Windows\windows.exe6⤵
- Executes dropped EXE
PID:2440
-
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2724
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2676
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2636
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2612
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1360
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2200
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2124
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1084
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1804
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1124
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:4516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3104
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4532 -ip 45322⤵PID:540
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f6e616f51c2ba0780eb9b809d6260f38 MUdI4/M1qUy3QM6+FfJEnA.0.1.0.0.01⤵PID:3608
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2084
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:4044
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:2220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4136
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5bc4ea5e0885c21886cc34feb9ee50c37
SHA11f82242fa23dd2aa0a7e579933e288fc352f5737
SHA256f1f7e118a5230f153e3cc9d4f067737aac5a4551a5e447941121b517c5377c60
SHA51254bc57a722283b1bed365f7cb50323b435a86ee41162b9085db76a0147ff64737b3081111c5208f97bbbe424aed5cf286609efb6ffceca73f1a3a83eca3f0f47
-
Filesize
637KB
MD50b16cabd2d4409e7fe84175dc5ab815a
SHA19bf32be127ab5c6a8c49435be5c6e17e984d01ef
SHA25609383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
SHA5129d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
Filesize
637KB
MD50b16cabd2d4409e7fe84175dc5ab815a
SHA19bf32be127ab5c6a8c49435be5c6e17e984d01ef
SHA25609383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
SHA5129d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
Filesize
637KB
MD50b16cabd2d4409e7fe84175dc5ab815a
SHA19bf32be127ab5c6a8c49435be5c6e17e984d01ef
SHA25609383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
SHA5129d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
Filesize
637KB
MD50b16cabd2d4409e7fe84175dc5ab815a
SHA19bf32be127ab5c6a8c49435be5c6e17e984d01ef
SHA25609383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
SHA5129d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
Filesize
637KB
MD50b16cabd2d4409e7fe84175dc5ab815a
SHA19bf32be127ab5c6a8c49435be5c6e17e984d01ef
SHA25609383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
SHA5129d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02