Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 06:41
Behavioral task
behavioral1
Sample
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe
Resource
win7-20220901-en
General
-
Target
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe
-
Size
283KB
-
MD5
a7202d29aa76f190df8e9fc7562408ea
-
SHA1
7d8e11b7129153ada60a583b7eb62bc16b17e15c
-
SHA256
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
-
SHA512
afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
SSDEEP
6144:Ck4qmpQXyNbtSu4fJ3ekS/kYqknRkYmPMbeE4CX8/13Qc:99OBSumOUYLiP4q/13Qc
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
127.0.0.1:288
yasr-q4.zapto.org:288
***MUTEX2***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
spy-net
-
install_file
Win_Xp.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Please try again later.
-
message_box_title
Error
-
password
abcd1234
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1832 Win_Xp.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "C:\\Windows\\system32\\spy-net\\Win_Xp.exe Restart" af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
resource yara_rule behavioral1/memory/1204-55-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1204-57-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1204-63-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1204-69-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1036-68-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x0009000000013a09-71.dat upx behavioral1/files/0x0009000000013a09-78.dat upx behavioral1/files/0x0009000000013a09-80.dat upx behavioral1/files/0x0009000000013a09-84.dat upx behavioral1/memory/1036-125-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1036-126-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1832-127-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1832-130-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/1832-131-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/1832-132-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1832-133-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/1036-135-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\spy-net\Win_Xp.exe af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe File opened for modification C:\Windows\SysWOW64\spy-net\Win_Xp.exe af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe Token: SeDebugPrivilege 1036 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27 PID 1204 wrote to memory of 1768 1204 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 27
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:484
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:324
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1152
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:768
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1068
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:296
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:884
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:852
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:816
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:680
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:600
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:492
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1904
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1036 -
C:\Windows\SysWOW64\spy-net\Win_Xp.exe"C:\Windows\system32\spy-net\Win_Xp.exe"4⤵
- Executes dropped EXE
PID:1832
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5207560a81acfd1c2a3d62770d7101e87
SHA1cc30b52173543d35c7c61f1c06b585676457f7ba
SHA256129061e12714570a096d39a4492de0a7af8e33a09c7df84cbca88c7e79a348c3
SHA512edafbc848e9d8863e728d9c9d6e3598fa105475676c44af1b54db58863e2f853a89c7337d1d1ab566ec94a1f2c693ba96e0dc900f9c4d720dee07d53046a2d5e
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84