Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 06:41
Behavioral task
behavioral1
Sample
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe
Resource
win7-20220901-en
General
-
Target
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe
-
Size
283KB
-
MD5
a7202d29aa76f190df8e9fc7562408ea
-
SHA1
7d8e11b7129153ada60a583b7eb62bc16b17e15c
-
SHA256
af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
-
SHA512
afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
SSDEEP
6144:Ck4qmpQXyNbtSu4fJ3ekS/kYqknRkYmPMbeE4CX8/13Qc:99OBSumOUYLiP4q/13Qc
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
127.0.0.1:288
yasr-q4.zapto.org:288
***MUTEX2***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
spy-net
-
install_file
Win_Xp.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Please try again later.
-
message_box_title
Error
-
password
abcd1234
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 4212 created 5068 4212 WerFault.exe 81 PID 3136 created 1620 3136 WerFault.exe 84 -
Executes dropped EXE 1 IoCs
pid Process 5068 Win_Xp.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML} af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218A3Q1V-M05N-O32L-4AM8-MA0JEIMDL4ML}\StubPath = "C:\\Windows\\system32\\spy-net\\Win_Xp.exe Restart" af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
resource yara_rule behavioral2/memory/1032-132-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/1032-134-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/1640-139-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/1032-140-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1640-143-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1032-144-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/files/0x0002000000021b43-146.dat upx behavioral2/memory/1640-147-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/files/0x0002000000021b43-149.dat upx behavioral2/memory/5068-150-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/4212-151-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/4212-152-0x0000000031BB0000-0x0000000031BBD000-memory.dmp upx behavioral2/memory/1620-153-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/3136-154-0x0000000031BE0000-0x0000000031BED000-memory.dmp upx behavioral2/memory/3136-155-0x0000000031BE0000-0x0000000031BED000-memory.dmp upx behavioral2/memory/724-156-0x0000000031C00000-0x0000000031C0D000-memory.dmp upx behavioral2/memory/5068-157-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral2/memory/5068-158-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/1620-159-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/724-160-0x0000000031C00000-0x0000000031C0D000-memory.dmp upx behavioral2/memory/724-161-0x0000000031C00000-0x0000000031C0D000-memory.dmp upx behavioral2/memory/1640-162-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\spy-net\Win_Xp.exe af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe File opened for modification C:\Windows\SysWOW64\spy-net\Win_Xp.exe af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1620 5068 WerFault.exe 81 724 1620 WerFault.exe 84 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 724 WerFault.exe 724 WerFault.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe Token: SeDebugPrivilege 1640 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe Token: SeRestorePrivilege 724 WerFault.exe Token: SeBackupPrivilege 724 WerFault.exe Token: SeBackupPrivilege 724 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79 PID 1032 wrote to memory of 2176 1032 af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe 79
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:684
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:332
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3416
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3344
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3256
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4668
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3968
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:1388
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4468
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3716
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3500
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:2396
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2976
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"C:\Users\Admin\AppData\Local\Temp\af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\SysWOW64\spy-net\Win_Xp.exe"C:\Windows\system32\spy-net\Win_Xp.exe"4⤵
- Executes dropped EXE
PID:5068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 5645⤵
- Program crash
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 6486⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2656
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2560
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2444
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2360
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:3240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:4320
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:3824
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2080
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1960
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1904
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1380
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1196
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1080
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:1116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5068 -ip 50682⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1620 -ip 16202⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3136
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 876af45bc6bec86cf094383006d1ac66 adZeTf7oDUiISZ8wMnQ12Q.0.1.0.0.01⤵PID:4952
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:5044
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:3048
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5207560a81acfd1c2a3d62770d7101e87
SHA1cc30b52173543d35c7c61f1c06b585676457f7ba
SHA256129061e12714570a096d39a4492de0a7af8e33a09c7df84cbca88c7e79a348c3
SHA512edafbc848e9d8863e728d9c9d6e3598fa105475676c44af1b54db58863e2f853a89c7337d1d1ab566ec94a1f2c693ba96e0dc900f9c4d720dee07d53046a2d5e
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84
-
Filesize
283KB
MD5a7202d29aa76f190df8e9fc7562408ea
SHA17d8e11b7129153ada60a583b7eb62bc16b17e15c
SHA256af83612cdf7f06a4954c82cd6dfb941332d731caf58b944850a94e9839d86341
SHA512afd1ad3fc67a78c4f6c2a08788f6baeeb3043da2a725eb1e1d160f2e1e3552879d29ff6e7dda39d7e89eb818e8344bb2e4aef2babf25f6aecfafb2ba73ef4b84