Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe
-
Size
92KB
-
MD5
f2e8f8fe0b4d4d734d5304fd6ef16d47
-
SHA1
c999b38f3c226716e161f8a6b2346d386a6c218b
-
SHA256
38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
-
SHA512
a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
SSDEEP
1536:cgRswP+BgWekSIyUpbjFyjxEyxFJ7wRqqt:SwGKWeXIxFIEyt7Ydt
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" vmwareuser.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" vmwareuser.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" vmwareuser.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vmwareuser.exe -
Executes dropped EXE 6 IoCs
pid Process 916 vmwareuser.exe 1452 vmwareuser.exe 2036 vmwareuser.exe 1220 vmwareuser.exe 1084 vmwareuser.exe 1216 vmwareuser.exe -
Modifies Windows Firewall 1 TTPs 4 IoCs
pid Process 1780 netsh.exe 1688 netsh.exe 1900 netsh.exe 268 netsh.exe -
Sets file execution options in registry 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl\Debugger = "wuaucl" vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "wuaucl" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl\Debugger = "wuaucl" vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "wuaucl" vmwareuser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll\Debugger = "wuaucl" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Firewall.cpl\Debugger = "wuaucl" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FirewallAPI.dll\Debugger = "wuaucl" vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe vmwareuser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe vmwareuser.exe -
resource yara_rule behavioral1/memory/1788-56-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1788-59-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1788-60-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1788-75-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1084-101-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1084-102-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1220-100-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1084-105-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1216-116-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*MalwareBytes0 = "\"C:\\ProgramData\\MalwareBytes0\\conhost.exe\"" 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Drops file in System32 directory 56 IoCs
description ioc Process File created C:\Windows\SysWow64\Firewall.cpl:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWow64\FirewallAPI.dll:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWOW64\mmc.exe:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWow64\Firewall.cpl:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWow64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWow64\Firewall.cpl:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWOW64\Firewall.cpl:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\Firewall.cpl vmwareuser.exe File created C:\Windows\SysWOW64\Firewall.cpl:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWow64\Firewall.cpl vmwareuser.exe File created C:\Windows\SysWow64\mmc.exe:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\rstrui.exe vmwareuser.exe File created C:\Windows\SysWow64\Firewall.cpl:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\rstrui.exe 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\FirewallAPI.dll 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\rstrui.exe 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\FirewallAPI.dll vmwareuser.exe File opened for modification C:\Windows\SysWOW64\FirewallAPI.dll vmwareuser.exe File created C:\Windows\SysWOW64\FirewallAPI.dll:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\Firewall.cpl 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWow64\mmc.exe:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWow64\FirewallAPI.dll vmwareuser.exe File opened for modification C:\Windows\SysWOW64\rstrui.exe vmwareuser.exe File created C:\Windows\SysWow64\mmc.exe:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWOW64\Firewall.cpl vmwareuser.exe File created C:\Windows\SysWOW64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWow64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWOW64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWow64\Firewall.cpl vmwareuser.exe File opened for modification C:\Windows\SysWow64\mmc.exe vmwareuser.exe File created C:\Windows\SysWOW64\Firewall.cpl:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\rstrui.exe vmwareuser.exe File created C:\Windows\SysWOW64\mmc.exe:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\rstrui.exe vmwareuser.exe File created C:\Windows\SysWow64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\FirewallAPI.dll vmwareuser.exe File opened for modification C:\Windows\SysWOW64\mmc.exe vmwareuser.exe File opened for modification C:\Windows\SysWow64\mmc.exe vmwareuser.exe File opened for modification C:\Windows\SysWOW64\mmc.exe vmwareuser.exe File opened for modification C:\Windows\SysWOW64\Firewall.cpl 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWOW64\mmc.exe:Zone.Identifier 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWow64\mmc.exe:Zone.Identifier vmwareuser.exe File created C:\Windows\SysWOW64\mmc.exe:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWow64\rstrui.exe vmwareuser.exe File opened for modification C:\Windows\SysWOW64\FirewallAPI.dll vmwareuser.exe File created C:\Windows\SysWOW64\FirewallAPI.dll:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWOW64\mmc.exe vmwareuser.exe File opened for modification C:\Windows\SysWow64\FirewallAPI.dll vmwareuser.exe File opened for modification C:\Windows\SysWOW64\Firewall.cpl vmwareuser.exe File opened for modification C:\Windows\SysWow64\mmc.exe vmwareuser.exe File opened for modification C:\Windows\SysWOW64\FirewallAPI.dll 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File created C:\Windows\SysWOW64\Firewall.cpl:Zone.Identifier vmwareuser.exe File opened for modification C:\Windows\SysWow64\mmc.exe 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe File opened for modification C:\Windows\SysWow64\Firewall.cpl vmwareuser.exe File opened for modification C:\Windows\SysWOW64\rstrui.exe vmwareuser.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 536 set thread context of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 1452 set thread context of 1220 1452 vmwareuser.exe 34 PID 916 set thread context of 1084 916 vmwareuser.exe 35 PID 2036 set thread context of 1216 2036 vmwareuser.exe 40 -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1712 sc.exe 848 sc.exe 1448 sc.exe 1208 sc.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vmwareuser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vmwareuser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vmwareuser.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer vmwareuser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer vmwareuser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS vmwareuser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer vmwareuser.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe Token: SeDebugPrivilege 1220 vmwareuser.exe Token: SeDebugPrivilege 1084 vmwareuser.exe Token: SeDebugPrivilege 1216 vmwareuser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 916 vmwareuser.exe 1452 vmwareuser.exe 2036 vmwareuser.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 536 wrote to memory of 1788 536 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 28 PID 1788 wrote to memory of 1712 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 29 PID 1788 wrote to memory of 1712 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 29 PID 1788 wrote to memory of 1712 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 29 PID 1788 wrote to memory of 1712 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 29 PID 1788 wrote to memory of 1780 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 30 PID 1788 wrote to memory of 1780 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 30 PID 1788 wrote to memory of 1780 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 30 PID 1788 wrote to memory of 1780 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 30 PID 1788 wrote to memory of 916 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 31 PID 1788 wrote to memory of 916 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 31 PID 1788 wrote to memory of 916 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 31 PID 1788 wrote to memory of 916 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 31 PID 1788 wrote to memory of 1452 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 32 PID 1788 wrote to memory of 1452 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 32 PID 1788 wrote to memory of 1452 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 32 PID 1788 wrote to memory of 1452 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 32 PID 1788 wrote to memory of 2036 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 33 PID 1788 wrote to memory of 2036 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 33 PID 1788 wrote to memory of 2036 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 33 PID 1788 wrote to memory of 2036 1788 38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe 33 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 1452 wrote to memory of 1220 1452 vmwareuser.exe 34 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 916 wrote to memory of 1084 916 vmwareuser.exe 35 PID 1220 wrote to memory of 848 1220 vmwareuser.exe 36 PID 1220 wrote to memory of 848 1220 vmwareuser.exe 36 PID 1220 wrote to memory of 848 1220 vmwareuser.exe 36 PID 1220 wrote to memory of 848 1220 vmwareuser.exe 36 PID 1220 wrote to memory of 1688 1220 vmwareuser.exe 37 PID 1220 wrote to memory of 1688 1220 vmwareuser.exe 37 PID 1220 wrote to memory of 1688 1220 vmwareuser.exe 37 PID 1220 wrote to memory of 1688 1220 vmwareuser.exe 37 PID 1084 wrote to memory of 1448 1084 vmwareuser.exe 39 PID 1084 wrote to memory of 1448 1084 vmwareuser.exe 39 PID 1084 wrote to memory of 1448 1084 vmwareuser.exe 39 PID 1084 wrote to memory of 1448 1084 vmwareuser.exe 39 PID 1084 wrote to memory of 1900 1084 vmwareuser.exe 38 PID 1084 wrote to memory of 1900 1084 vmwareuser.exe 38 PID 1084 wrote to memory of 1900 1084 vmwareuser.exe 38 PID 1084 wrote to memory of 1900 1084 vmwareuser.exe 38 PID 2036 wrote to memory of 1216 2036 vmwareuser.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe"C:\Users\Admin\AppData\Local\Temp\38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe"C:\Users\Admin\AppData\Local\Temp\38abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c.exe"2⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\sc.exesc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1712
-
-
C:\Windows\SysWOW64\netsh.exenetsh.exe firewall set opmode mode=disable profile=all3⤵
- Modifies Windows Firewall
PID:1780
-
-
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Sets file execution options in registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\netsh.exenetsh.exe firewall set opmode mode=disable profile=all5⤵
- Modifies Windows Firewall
PID:1900
-
-
C:\Windows\SysWOW64\sc.exesc.exe config SharedAccess start= disabled5⤵
- Launches sc.exe
PID:1448
-
-
-
-
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe4⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Sets file execution options in registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\sc.exesc.exe config SharedAccess start= disabled5⤵
- Launches sc.exe
PID:848
-
-
C:\Windows\SysWOW64\netsh.exenetsh.exe firewall set opmode mode=disable profile=all5⤵
- Modifies Windows Firewall
PID:1688
-
-
-
-
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\ProgramData\MalwareBytes0\vmwareuser.exeC:\ProgramData\MalwareBytes0\vmwareuser.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Sets file execution options in registry
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1216 -
C:\Windows\SysWOW64\sc.exesc.exe config SharedAccess start= disabled5⤵
- Launches sc.exe
PID:1208
-
-
C:\Windows\SysWOW64\netsh.exenetsh.exe firewall set opmode mode=disable profile=all5⤵
- Modifies Windows Firewall
PID:268
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6
-
Filesize
92KB
MD5f2e8f8fe0b4d4d734d5304fd6ef16d47
SHA1c999b38f3c226716e161f8a6b2346d386a6c218b
SHA25638abb6d28cc0ead48ecfd47f0598a3957ec4f4d068b268eaedb8accb97410e4c
SHA512a31f7b4c318bd76a40be273463571c8eeadbd0293393226a8a16cc84ca5ec78e906d5bcc645e62788f8f3c1e1ee7de592ab23f8a0c2f945274839e493e3ed0e6