Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 22:47
Static task
static1
Behavioral task
behavioral1
Sample
983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe
Resource
win10v2004-20221111-en
General
-
Target
983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe
-
Size
25KB
-
MD5
0ba6a784f270f68fa6e102277f9e04c0
-
SHA1
21c2094526da9ee107fd4421f70e73acfe8c269f
-
SHA256
983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
-
SHA512
d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e
-
SSDEEP
768:OqbKI+C2pbyw15X/WllPlqZrpvUnPius:tKI+C2pWw1kzNq7MPiu
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1348 csrss.exe 388 csrss.exe 1032 csrss.exe 1156 csrss.exe -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\n.ini 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe File created C:\Windows\SysWOW64\wbem\csrss.exe 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe File opened for modification C:\Windows\SysWOW64\n.ini csrss.exe File created C:\Windows\SysWOW64\wbem\csrss.exe csrss.exe File created C:\Windows\SysWOW64\wbem\csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\n.ini csrss.exe File opened for modification C:\Windows\SysWOW64\n.ini 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe File opened for modification C:\Windows\SysWOW64\wbem\csrss.exe 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe File opened for modification C:\Windows\SysWOW64\n.ini csrss.exe File opened for modification C:\Windows\SysWOW64\n.ini csrss.exe File created C:\Windows\SysWOW64\wbem\csrss.exe csrss.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001095" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000b9ce907c647c044bba4a2f18fee53815a2e427bf518f67a93d1d780b7b7cc080000000000e80000000020000200000004f250044c2d170424d60f1222ae662fd443058c7908a1457d255d5a8eeab6a8f20000000b4887a2c66affb56f2b4644e9485c6da35c838a7d85e04f30376bfff37a26f43400000007acab01c8da03c60bc97e353d4f5726223991f92db976abaf4e115f35d98fa3774a2e5c17c39fe177fa1082c8796fcc12c838902afaec8d0c73f99ca4d9c43da iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3171241715" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000a9ea9407582728ba4f7197b3a3e83402535509a39474e5d7bfeed54d09c06505000000000e800000000200002000000081059e8dbf583c3d101213c86fdf045688d0893d635ad9ecee324419afa1fb35200000005db5902edc53e62a5f58cfa7b3e6e244748f55ddd4c37a2d73e9962765239a8a40000000f63bf3b7e93249e6401ca0675121cc413eadc9237b36a5fa94f95289dee5a657f3d7275759f70c5a62e43f1f8d77c2d3d1b5eacdf921cc0dcf6730af2c018eea iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c9748000000000200000000001066000000010000200000007e0636bc5b3036e66c80d3689bbf9e7f7f4a28cc26be0754049483230c8c2c92000000000e80000000020000200000007372cdb1d3569da913d7ec550b4ef9beff8770cd752c670f6f97e0a45894f8da20000000e5be38f5b5df492235d2b6b4bdd09addcc432408ae0fac518e7d25be05ce4504400000007deab19fbe4b480913aa5d9d853904c22e675a090d170f8c8f0fc1989b12fefd9c36c7e67880c04a16cf0c97dc0f51f8afe460cd1208b6bed86aa03b2f2c8d7b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302752e7070ad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0da30df070ad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E09E1F5E-75FA-11ED-919F-D668443210E4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3171241715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00bf3d3070ad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{184D2CCC-75FB-11ED-919F-D668443210E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3221240985" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c9748000000000200000000001066000000010000200000007cb757328347a1fb4632f2e939eb279848049f56b0b183057693213786cefdaa000000000e8000000002000020000000b36ddcb5f5dc40381941c21ba5e64a7365b3901f61f4e09f2731c7441077c40c200000009e5203ea509c1a37b21b4f3fb9934bc028a0492b2d9c3532fb914e87e53447e0400000009e4cc72f2e20ffcfea4c3941d851259479511066b6fd3eb9abc8f98df418eadbae7c4dd5eadf1f69ace73e255a20f8fa7277d092f9b85442fa00fc6a0100925d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3221240985" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001095" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377160588" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{208FF132-75FB-11ED-919F-D668443210E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001095" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001095" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fe61d8070ad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 1348 csrss.exe 1348 csrss.exe 388 csrss.exe 388 csrss.exe 1032 csrss.exe 1032 csrss.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4432 iexplore.exe 1716 iexplore.exe 1840 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4432 iexplore.exe 4432 iexplore.exe 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1716 iexplore.exe 1716 iexplore.exe 4056 IEXPLORE.EXE 4056 IEXPLORE.EXE 1840 iexplore.exe 1840 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1204 4432 iexplore.exe 85 PID 4432 wrote to memory of 1204 4432 iexplore.exe 85 PID 4432 wrote to memory of 1204 4432 iexplore.exe 85 PID 4256 wrote to memory of 1348 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 95 PID 4256 wrote to memory of 1348 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 95 PID 4256 wrote to memory of 1348 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 95 PID 4256 wrote to memory of 3612 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 96 PID 4256 wrote to memory of 3612 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 96 PID 4256 wrote to memory of 3612 4256 983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe 96 PID 1348 wrote to memory of 388 1348 csrss.exe 100 PID 1348 wrote to memory of 388 1348 csrss.exe 100 PID 1348 wrote to memory of 388 1348 csrss.exe 100 PID 1348 wrote to memory of 5052 1348 csrss.exe 101 PID 1348 wrote to memory of 5052 1348 csrss.exe 101 PID 1348 wrote to memory of 5052 1348 csrss.exe 101 PID 1716 wrote to memory of 4056 1716 iexplore.exe 105 PID 1716 wrote to memory of 4056 1716 iexplore.exe 105 PID 1716 wrote to memory of 4056 1716 iexplore.exe 105 PID 388 wrote to memory of 1032 388 csrss.exe 106 PID 388 wrote to memory of 1032 388 csrss.exe 106 PID 388 wrote to memory of 1032 388 csrss.exe 106 PID 388 wrote to memory of 1796 388 csrss.exe 107 PID 388 wrote to memory of 1796 388 csrss.exe 107 PID 388 wrote to memory of 1796 388 csrss.exe 107 PID 1840 wrote to memory of 3068 1840 iexplore.exe 110 PID 1840 wrote to memory of 3068 1840 iexplore.exe 110 PID 1840 wrote to memory of 3068 1840 iexplore.exe 110 PID 1032 wrote to memory of 1156 1032 csrss.exe 111 PID 1032 wrote to memory of 1156 1032 csrss.exe 111 PID 1032 wrote to memory of 1156 1032 csrss.exe 111 PID 1032 wrote to memory of 4664 1032 csrss.exe 112 PID 1032 wrote to memory of 4664 1032 csrss.exe 112 PID 1032 wrote to memory of 4664 1032 csrss.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe"C:\Users\Admin\AppData\Local\Temp\983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\wbem\csrss.exeC:\Windows\system32\wbem\csrss.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\wbem\csrss.exeC:\Windows\system32\wbem\csrss.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\wbem\csrss.exeC:\Windows\system32\wbem\csrss.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\wbem\csrss.exeC:\Windows\system32\wbem\csrss.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp.bat5⤵PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp.bat4⤵PID:1796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp.bat3⤵PID:5052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\temp.bat2⤵PID:3612
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3236
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4432 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160B
MD5688de2c11d07cd1a0f0a22aaba2f38fe
SHA1c693ee247172adf49b1fe68c597358b0e0e2477e
SHA2568fd8370941a44a938f35789dae430fe4ee8bb1443f05baad544b48c261ae40d7
SHA512d1ecc15e5e1da8d9f35f95ed2b66763ed314e9b523dacd1eb42332b8f3d9c8256f46830c7b9c107ada42cc51d4dfe6ac9cd845b6fdbcf25677c5c50b138bde0a
-
Filesize
160B
MD5688de2c11d07cd1a0f0a22aaba2f38fe
SHA1c693ee247172adf49b1fe68c597358b0e0e2477e
SHA2568fd8370941a44a938f35789dae430fe4ee8bb1443f05baad544b48c261ae40d7
SHA512d1ecc15e5e1da8d9f35f95ed2b66763ed314e9b523dacd1eb42332b8f3d9c8256f46830c7b9c107ada42cc51d4dfe6ac9cd845b6fdbcf25677c5c50b138bde0a
-
Filesize
160B
MD5688de2c11d07cd1a0f0a22aaba2f38fe
SHA1c693ee247172adf49b1fe68c597358b0e0e2477e
SHA2568fd8370941a44a938f35789dae430fe4ee8bb1443f05baad544b48c261ae40d7
SHA512d1ecc15e5e1da8d9f35f95ed2b66763ed314e9b523dacd1eb42332b8f3d9c8256f46830c7b9c107ada42cc51d4dfe6ac9cd845b6fdbcf25677c5c50b138bde0a
-
Filesize
296B
MD56d4b95098b9a9f9cba6abb84be3f325f
SHA1635dbf01655aa7c254a0742eeccfcc10448ebe3e
SHA25648f32a7b5091f7a2603c9679bfd5183e8a4490603e6d9225d3c4d91c1ff548f5
SHA512a6d05c46f3bcbf3f71f85e796caeaa9435eeb6261972bb5a0e9f00894a22453025e6c1c2861a18301fc2bdae4751d39740d2b2a84976d3e75480fae3f74cdc40
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
19B
MD5e415f059d8566da0d8d44108e0e915fe
SHA134dff1c646f465308c2804f0f046bbdcdfb53661
SHA256b6765a3102953c72201321bfe2ef838e13e3ce395ef26c72e515a140e6d6d782
SHA512fde3978b4d56abe680806dc62e6b9ad7f10ef2c6cbb1c7999c2f64c180056a600b98503446a1f3d2bd46487ef84d9a13ec1f3246d00451610a51af3fb21fec1b
-
Filesize
25KB
MD50ba6a784f270f68fa6e102277f9e04c0
SHA121c2094526da9ee107fd4421f70e73acfe8c269f
SHA256983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
SHA512d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e
-
Filesize
25KB
MD50ba6a784f270f68fa6e102277f9e04c0
SHA121c2094526da9ee107fd4421f70e73acfe8c269f
SHA256983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
SHA512d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e
-
Filesize
25KB
MD50ba6a784f270f68fa6e102277f9e04c0
SHA121c2094526da9ee107fd4421f70e73acfe8c269f
SHA256983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
SHA512d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e
-
Filesize
25KB
MD50ba6a784f270f68fa6e102277f9e04c0
SHA121c2094526da9ee107fd4421f70e73acfe8c269f
SHA256983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
SHA512d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e
-
Filesize
25KB
MD50ba6a784f270f68fa6e102277f9e04c0
SHA121c2094526da9ee107fd4421f70e73acfe8c269f
SHA256983f658e8f38cad710e854b4631c8f3b632c57b537506d98c67e80712f14429e
SHA512d6be5cce86a6edf0b43815adc58bfda9fa9867dd3fcaf68a40e18fe03d938edc7b35a84ff90d5ff2875b6499f6ed47d874ec95b6e2663a418cb6971c3089996e