Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
-
Size
791KB
-
MD5
63d1eee88fd628d4671419c323b9e77a
-
SHA1
2849c45484492839c4c114ec9b0e96db88a12d72
-
SHA256
ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd
-
SHA512
57afcf5bc6cb28d51f15e259fcd19d5adf98c81b1703ab0d84370d604dd8719701f8b69c0b3d0684daed9cfbbee93ef03e01fd48118df8654e5047332104fa5a
-
SSDEEP
12288:END7cWU6wDL+En5wSYcy+7shhPTQ1S3qy+GKBmHJ5hyrJL2jrmQYWcoep58Xb/7W:END7B6ubhGkZKBmHTrHYWcRIs74w
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 556 set thread context of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 set thread context of 0 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ = "_PropertyBag" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ = "ParentControls" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ = "AmbientProperties" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ = "EventParameters" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ = "EventParameter" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\ = "{000204EF-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\ = "EventInfo" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82} ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ProxyStubClsid32 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 2480 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 79 PID 556 wrote to memory of 0 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe PID 556 wrote to memory of 0 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe PID 556 wrote to memory of 0 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe PID 556 wrote to memory of 0 556 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe PID 2480 wrote to memory of 2720 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 52 PID 2480 wrote to memory of 2720 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 52 PID 2480 wrote to memory of 2720 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 52 PID 2480 wrote to memory of 2720 2480 ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2720