Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe
Resource
win7-20221111-en
General
-
Target
cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe
-
Size
444KB
-
MD5
eb111f9fe456168885f20b8900381868
-
SHA1
11bcceb9365462546aef9a2bab220ea0c85552ba
-
SHA256
cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
-
SHA512
f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473
-
SSDEEP
6144:XY9DqednsIhDeKamc7n8JIiZjECUT8r7D76xdds2yRmi/aYEoY6Lqg5Z5ajATJNz:X0dnsIhKKaX8tZA76/UGDXV5PwcSMWwh
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
127.0.0.1:288
saleh1.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
abcd1234
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Executes dropped EXE 2 IoCs
pid Process 1268 windows.exe 1196 windows.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe Restart" cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe" explorer.exe -
resource yara_rule behavioral1/memory/844-81-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/844-91-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/760-96-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/760-97-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/844-99-0x0000000000280000-0x00000000002E2000-memory.dmp upx behavioral1/memory/760-105-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/844-106-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1872-111-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1872-113-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/760-188-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/1872-194-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1196-196-0x0000000031910000-0x000000003191D000-memory.dmp upx behavioral1/memory/1196-198-0x0000000031910000-0x000000003191D000-memory.dmp upx behavioral1/memory/760-199-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/760-246-0x0000000031AA0000-0x0000000031AAD000-memory.dmp upx behavioral1/memory/760-247-0x0000000031AA0000-0x0000000031AAD000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe File opened for modification \??\c:\windows\SysWOW64\microsoft\ cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe File created \??\c:\windows\SysWOW64\microsoft\windows.exe cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 940 set thread context of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 1268 set thread context of 1196 1268 windows.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe Token: SeDebugPrivilege 1872 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 1268 windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 940 wrote to memory of 844 940 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 28 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11 PID 844 wrote to memory of 1376 844 cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe 11
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:832
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1036
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:908
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:748
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1216
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:876
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:480
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe"C:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exeC:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
PID:760
-
-
C:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe"C:\Users\Admin\AppData\Local\Temp\cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\windows\SysWOW64\microsoft\windows.exe"C:\windows\system32\microsoft\windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\windows\SysWOW64\microsoft\windows.exeC:\windows\SysWOW64\microsoft\windows.exe6⤵
- Executes dropped EXE
PID:1196
-
-
-
-
-
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1704
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1972
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5f45507de2129dd589d1a07ba64a29318
SHA1762d6bc722aee60a186a1a3a367b8d52acd0eba5
SHA256c24b34b99d6b08312713cd65ebbde6cb4953d6d711c0bb290ed38cceb7ab3859
SHA5125e16f3f9c02e1b0b7abc10bdaa402884fb81696017e1c98ed4c7a4c04bc876ae876f696abf6d76ae0eec4f3d39fe419fde2ffc72c58429235e53d282a5eb5c6e
-
Filesize
444KB
MD5eb111f9fe456168885f20b8900381868
SHA111bcceb9365462546aef9a2bab220ea0c85552ba
SHA256cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
SHA512f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473
-
Filesize
444KB
MD5eb111f9fe456168885f20b8900381868
SHA111bcceb9365462546aef9a2bab220ea0c85552ba
SHA256cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
SHA512f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473
-
Filesize
444KB
MD5eb111f9fe456168885f20b8900381868
SHA111bcceb9365462546aef9a2bab220ea0c85552ba
SHA256cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
SHA512f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473
-
Filesize
444KB
MD5eb111f9fe456168885f20b8900381868
SHA111bcceb9365462546aef9a2bab220ea0c85552ba
SHA256cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
SHA512f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473
-
Filesize
444KB
MD5eb111f9fe456168885f20b8900381868
SHA111bcceb9365462546aef9a2bab220ea0c85552ba
SHA256cdefb33bfb3bf32435053cbe8627389d6adbeab4294ed2451362e7365dc23582
SHA512f7a91c24f5e0d986c957cb9e5d9030c7f2617d9e6645f4f5334b8faaac16f50a5ca28d0fbf2b6e17056ce3d91e5b49000a6c76d7c36bd7f43291cd1214300473