Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 02:35
Behavioral task
behavioral1
Sample
4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe
Resource
win7-20220812-en
General
-
Target
4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe
-
Size
334KB
-
MD5
03b58e0c6584c295ab78ca22112431e0
-
SHA1
d1d61b3d2f03a75fa425abd4652f5cc95e68ffcb
-
SHA256
4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae
-
SHA512
a5ff5654e2c3947b3d27c84c03902f07b2ba3b5e9e1745d3ffdceb1d349848dd0c350db7ad1b6ab8ebcac401537570a651a78c1e8df71a31bb88426df2894da5
-
SSDEEP
6144:k9bFzdSc7HqVdLNLko2xyPmwQoSBJVc6/2eNvsKPdE:azEKHadpLgyP6oS9t2eNvseK
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 3 IoCs
pid Process 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 2024 DesktopLayer.exe -
resource yara_rule behavioral1/files/0x0009000000012758-55.dat upx behavioral1/files/0x0009000000012758-56.dat upx behavioral1/files/0x0009000000012758-58.dat upx behavioral1/memory/2020-64-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2020-70-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/2024-73-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1072-76-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1072-80-0x0000000000400000-0x00000000004C3000-memory.dmp upx -
Loads dropped DLL 8 IoCs
pid Process 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\Program Files (x86)\Microsoft\px47CB.tmp 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MIE74D~1\DESKTO~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377184537" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A82F7C01-7632-11ED-8FA4-466E2F293893} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2024 DesktopLayer.exe 2024 DesktopLayer.exe 2024 DesktopLayer.exe 2024 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1376 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 1376 iexplore.exe 1376 iexplore.exe 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 2024 DesktopLayer.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1072 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 28 PID 1880 wrote to memory of 1072 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 28 PID 1880 wrote to memory of 1072 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 28 PID 1880 wrote to memory of 1072 1880 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 28 PID 1072 wrote to memory of 2020 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 29 PID 1072 wrote to memory of 2020 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 29 PID 1072 wrote to memory of 2020 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 29 PID 1072 wrote to memory of 2020 1072 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe 29 PID 2020 wrote to memory of 2024 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 30 PID 2020 wrote to memory of 2024 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 30 PID 2020 wrote to memory of 2024 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 30 PID 2020 wrote to memory of 2024 2020 4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe 30 PID 2024 wrote to memory of 1376 2024 DesktopLayer.exe 31 PID 2024 wrote to memory of 1376 2024 DesktopLayer.exe 31 PID 2024 wrote to memory of 1376 2024 DesktopLayer.exe 31 PID 2024 wrote to memory of 1376 2024 DesktopLayer.exe 31 PID 1376 wrote to memory of 1796 1376 iexplore.exe 33 PID 1376 wrote to memory of 1796 1376 iexplore.exe 33 PID 1376 wrote to memory of 1796 1376 iexplore.exe 33 PID 1376 wrote to memory of 1796 1376 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe"C:\Users\Admin\AppData\Local\Temp\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exeC:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1376 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
Filesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe
Filesize294KB
MD52916a56fedb0f824176536b2393390b1
SHA1b05a6f980d6be9cea6e8fed3632743c5b573ecbc
SHA2567db951882ca88e2f32202e1dc652e69d9bef58e144f5dab743f6d29673e9fc4e
SHA512ac74ec8b40f02b59408f03025559f1262635b70ec3ebf331c591c0f394cf021a5b6577d183b9d20c1f7e8eac899138aadd91802889d2a77e6696913b2b6a0f22
-
C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe
Filesize52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe
Filesize52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
Filesize
608B
MD574a405decddcb59df18d358a59ae5d4e
SHA1f16ecf7d05172ed5a64067608b6856239c705f16
SHA256347f91170d04305f7e21bc4772f92239e619a6d70d405556aed3cd497d11dcac
SHA512a7336445c01e01d6ef757b3ffd7cd437df871506ad7833e5b8f51b4bfeb1cb6ae945f02675e7052ff471d87a829660401a6d4fe63efd91a083213a9dfc05b2a9
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
Filesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
Filesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe
Filesize294KB
MD52916a56fedb0f824176536b2393390b1
SHA1b05a6f980d6be9cea6e8fed3632743c5b573ecbc
SHA2567db951882ca88e2f32202e1dc652e69d9bef58e144f5dab743f6d29673e9fc4e
SHA512ac74ec8b40f02b59408f03025559f1262635b70ec3ebf331c591c0f394cf021a5b6577d183b9d20c1f7e8eac899138aadd91802889d2a77e6696913b2b6a0f22
-
\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaae.exe
Filesize294KB
MD52916a56fedb0f824176536b2393390b1
SHA1b05a6f980d6be9cea6e8fed3632743c5b573ecbc
SHA2567db951882ca88e2f32202e1dc652e69d9bef58e144f5dab743f6d29673e9fc4e
SHA512ac74ec8b40f02b59408f03025559f1262635b70ec3ebf331c591c0f394cf021a5b6577d183b9d20c1f7e8eac899138aadd91802889d2a77e6696913b2b6a0f22
-
\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe
Filesize52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\3582-490\4510d89b0202d10ef5278296812c1d41c78ee0036819b46b7597325c014ddaaeSrv.exe
Filesize52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450