Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe
Resource
win10v2004-20220901-en
General
-
Target
a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe
-
Size
544KB
-
MD5
5cd70285850990f027d00d6ee387ea96
-
SHA1
92ea8c28490cb6e1734db4ab31069083aa8ae601
-
SHA256
a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1
-
SHA512
309d440024b4ac3167198b46b478043af1d158e66a77ef8f25408b74d3260963c1fa5c7f92eb06d7a59fc545267b78083d25b6c69e6b1d6fb0554c4568a86ae8
-
SSDEEP
12288:BQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:BQI+cJHiJRTHnxhUqEhe9suB2C8O9O
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gau5f8p1.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weecea.exe -
Executes dropped EXE 10 IoCs
pid Process 1760 gau5f8p1.exe 3380 2des.exe 3892 weecea.exe 4520 2des.exe 4176 2des.exe 1184 2des.exe 1084 2des.exe 1272 2des.exe 1996 3des.exe 5108 X -
resource yara_rule behavioral2/memory/4520-151-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4520-156-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4176-161-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1184-164-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1184-170-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4176-166-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1184-173-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1084-172-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4176-162-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4520-158-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4176-157-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1084-176-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1084-178-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1184-185-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1084-186-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4520-187-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1184-196-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation gau5f8p1.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /A" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /F" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /e" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /E" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /q" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /a" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /o" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /P" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /Q" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /L" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /K" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /H" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /D" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /V" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /b" weecea.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /d" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /n" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /B" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /f" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /p" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /j" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /N" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /r" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /y" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /J" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /t" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /m" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /o" gau5f8p1.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /v" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /u" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /k" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /g" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /U" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /W" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /Y" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /T" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /O" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /h" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /c" weecea.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gau5f8p1.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /i" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /z" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /M" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /I" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /X" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /w" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /x" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /s" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /l" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /C" weecea.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weecea = "C:\\Users\\Admin\\weecea.exe /S" weecea.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2des.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2des.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3380 set thread context of 4520 3380 2des.exe 89 PID 3380 set thread context of 4176 3380 2des.exe 91 PID 3380 set thread context of 1184 3380 2des.exe 92 PID 3380 set thread context of 1084 3380 2des.exe 93 PID 3380 set thread context of 1272 3380 2des.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4868 1272 WerFault.exe 94 -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 380 tasklist.exe 3568 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 gau5f8p1.exe 1760 gau5f8p1.exe 1760 gau5f8p1.exe 1760 gau5f8p1.exe 4176 2des.exe 4176 2des.exe 1184 2des.exe 1184 2des.exe 3892 weecea.exe 3892 weecea.exe 1996 3des.exe 1996 3des.exe 5108 X 5108 X 5108 X 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 3892 weecea.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 1184 2des.exe 1184 2des.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 4176 2des.exe 3892 weecea.exe 3892 weecea.exe 4176 2des.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 380 tasklist.exe Token: SeDebugPrivilege 1996 3des.exe Token: SeDebugPrivilege 1996 3des.exe Token: SeShutdownPrivilege 2248 Explorer.EXE Token: SeCreatePagefilePrivilege 2248 Explorer.EXE Token: SeShutdownPrivilege 2248 Explorer.EXE Token: SeCreatePagefilePrivilege 2248 Explorer.EXE Token: SeDebugPrivilege 3568 tasklist.exe Token: SeShutdownPrivilege 2248 Explorer.EXE Token: SeCreatePagefilePrivilege 2248 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 1760 gau5f8p1.exe 3892 weecea.exe 3380 2des.exe 4520 2des.exe 1084 2des.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 3488 wrote to memory of 1760 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 81 PID 3488 wrote to memory of 1760 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 81 PID 3488 wrote to memory of 1760 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 81 PID 1760 wrote to memory of 3892 1760 gau5f8p1.exe 84 PID 1760 wrote to memory of 3892 1760 gau5f8p1.exe 84 PID 1760 wrote to memory of 3892 1760 gau5f8p1.exe 84 PID 3488 wrote to memory of 3380 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 85 PID 3488 wrote to memory of 3380 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 85 PID 3488 wrote to memory of 3380 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 85 PID 1760 wrote to memory of 4040 1760 gau5f8p1.exe 88 PID 1760 wrote to memory of 4040 1760 gau5f8p1.exe 88 PID 1760 wrote to memory of 4040 1760 gau5f8p1.exe 88 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 3380 wrote to memory of 4520 3380 2des.exe 89 PID 4040 wrote to memory of 380 4040 cmd.exe 90 PID 4040 wrote to memory of 380 4040 cmd.exe 90 PID 4040 wrote to memory of 380 4040 cmd.exe 90 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 4176 3380 2des.exe 91 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1184 3380 2des.exe 92 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1084 3380 2des.exe 93 PID 3380 wrote to memory of 1272 3380 2des.exe 94 PID 3380 wrote to memory of 1272 3380 2des.exe 94 PID 3380 wrote to memory of 1272 3380 2des.exe 94 PID 3380 wrote to memory of 1272 3380 2des.exe 94 PID 3488 wrote to memory of 1996 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 97 PID 3488 wrote to memory of 1996 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 97 PID 3488 wrote to memory of 1996 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 97 PID 1996 wrote to memory of 5108 1996 3des.exe 98 PID 1996 wrote to memory of 5108 1996 3des.exe 98 PID 5108 wrote to memory of 2248 5108 X 37 PID 3488 wrote to memory of 1268 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 100 PID 3488 wrote to memory of 1268 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 100 PID 3488 wrote to memory of 1268 3488 a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe 100 PID 1268 wrote to memory of 3568 1268 cmd.exe 102 PID 1268 wrote to memory of 3568 1268 cmd.exe 102 PID 1268 wrote to memory of 3568 1268 cmd.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe"C:\Users\Admin\AppData\Local\Temp\a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\gau5f8p1.exeC:\Users\Admin\gau5f8p1.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\weecea.exe"C:\Users\Admin\weecea.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del gau5f8p1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
-
-
C:\Users\Admin\2des.exeC:\Users\Admin\2des.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 805⤵
- Program crash
PID:4868
-
-
-
-
C:\Users\Admin\3des.exeC:\Users\Admin\3des.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\33b020d7\X*0*bc*d25e6c51*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del a53415f5f735a4669a73c7ea8fd5ade5d2ce5f253a2de943e877cf0c3efa11d1.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1272 -ip 12721⤵PID:3004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
286KB
MD5cb278b7760c080ea4f57aea471f0f674
SHA12c052b2db7a196d127c2b84b62563d0c98ec0413
SHA25674cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930
SHA512dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3
-
Filesize
286KB
MD5cb278b7760c080ea4f57aea471f0f674
SHA12c052b2db7a196d127c2b84b62563d0c98ec0413
SHA25674cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930
SHA512dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
252KB
MD53e152747de87d4674484a003398db051
SHA182557817b08eb981afa68701092d9f6e0d71ef79
SHA2561d5897272a1b899ce244d0863e9cf743adf4a9f5838bed75b7fc6a6e31a9da3e
SHA512dd726c743cac5696bf225d4b8d5cfa7b28f218eb6e7f2325e4f75d3cc4539e417210d477bafbcd82e7eb9e7b4e8ce20ae6ad30e2e7d36d949223bed0c78dcfa7
-
Filesize
252KB
MD53e152747de87d4674484a003398db051
SHA182557817b08eb981afa68701092d9f6e0d71ef79
SHA2561d5897272a1b899ce244d0863e9cf743adf4a9f5838bed75b7fc6a6e31a9da3e
SHA512dd726c743cac5696bf225d4b8d5cfa7b28f218eb6e7f2325e4f75d3cc4539e417210d477bafbcd82e7eb9e7b4e8ce20ae6ad30e2e7d36d949223bed0c78dcfa7
-
Filesize
252KB
MD5dea23e7144f33418911d8108b25edff2
SHA1d02ec3a61794681a46e1c5c925ab8b7bd437c987
SHA2564dd8671e339e46e4abc4bf2227a9379a61bbe8cccf5e42d968f604845615df79
SHA5126266871dc0b4cbd4d11231ce281605e4a8062b9f8aac964fc6483fba1df08fb1f2293b677e99229592aff157d610d07ae50863c7b6a393ac6a3c8244140ffc4c
-
Filesize
252KB
MD5dea23e7144f33418911d8108b25edff2
SHA1d02ec3a61794681a46e1c5c925ab8b7bd437c987
SHA2564dd8671e339e46e4abc4bf2227a9379a61bbe8cccf5e42d968f604845615df79
SHA5126266871dc0b4cbd4d11231ce281605e4a8062b9f8aac964fc6483fba1df08fb1f2293b677e99229592aff157d610d07ae50863c7b6a393ac6a3c8244140ffc4c