Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe
Resource
win10v2004-20221111-en
General
-
Target
a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe
-
Size
556KB
-
MD5
032b91072be80281729f7c1f885eea80
-
SHA1
d34598ac37a8ac46d8472e2868bb59fd5b9111ce
-
SHA256
a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3
-
SHA512
0aca360435a62b9e13fe0c94ba1b77b9a500091528a54aff5415da8c1853f785d3d6c01c2bddbb66dfd39cead52720d9fa81b0a387c0124d2487da10b4f1dfd2
-
SSDEEP
12288:u7Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:u7L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NB4wr66jY4.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yzguj.exe -
Executes dropped EXE 10 IoCs
pid Process 1244 NB4wr66jY4.exe 4372 2xek.exe 4360 yzguj.exe 1780 2xek.exe 1088 2xek.exe 3128 2xek.exe 4380 2xek.exe 4788 2xek.exe 4504 3xek.exe 2084 X -
resource yara_rule behavioral2/memory/1088-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-157-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4380-161-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4380-165-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4788-166-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4380-167-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4380-171-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4788-173-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4788-174-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4788-177-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4788-182-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/3128-183-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1088-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-185-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1088-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-187-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1088-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation NB4wr66jY4.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /q" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /U" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /O" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /g" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /S" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /s" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /B" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /d" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /o" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /A" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /y" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /L" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /C" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /e" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /D" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /i" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /m" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /P" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /Q" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /Y" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /M" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /Z" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /l" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /T" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /H" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /G" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /k" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /w" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /a" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /I" yzguj.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /J" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /X" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /F" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /c" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /h" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /r" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /W" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /K" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /v" NB4wr66jY4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /V" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /n" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /u" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /E" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /R" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /b" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /v" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /x" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /N" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /t" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /z" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /f" yzguj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yzguj = "C:\\Users\\Admin\\yzguj.exe /p" yzguj.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2xek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2xek.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4372 set thread context of 1780 4372 2xek.exe 85 PID 4372 set thread context of 1088 4372 2xek.exe 87 PID 4372 set thread context of 3128 4372 2xek.exe 90 PID 4372 set thread context of 4380 4372 2xek.exe 91 PID 4372 set thread context of 4788 4372 2xek.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3848 tasklist.exe 1148 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 NB4wr66jY4.exe 1244 NB4wr66jY4.exe 1244 NB4wr66jY4.exe 1244 NB4wr66jY4.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe 4360 yzguj.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 752 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 3848 tasklist.exe Token: SeDebugPrivilege 4504 3xek.exe Token: SeDebugPrivilege 4504 3xek.exe Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeDebugPrivilege 1148 tasklist.exe Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE Token: SeShutdownPrivilege 752 Explorer.EXE Token: SeCreatePagefilePrivilege 752 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 752 Explorer.EXE 752 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 1244 NB4wr66jY4.exe 4372 2xek.exe 4360 yzguj.exe 4380 2xek.exe 4788 2xek.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1244 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 82 PID 1984 wrote to memory of 1244 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 82 PID 1984 wrote to memory of 1244 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 82 PID 1984 wrote to memory of 4372 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 83 PID 1984 wrote to memory of 4372 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 83 PID 1984 wrote to memory of 4372 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 83 PID 1244 wrote to memory of 4360 1244 NB4wr66jY4.exe 84 PID 1244 wrote to memory of 4360 1244 NB4wr66jY4.exe 84 PID 1244 wrote to memory of 4360 1244 NB4wr66jY4.exe 84 PID 4372 wrote to memory of 1780 4372 2xek.exe 85 PID 4372 wrote to memory of 1780 4372 2xek.exe 85 PID 4372 wrote to memory of 1780 4372 2xek.exe 85 PID 1244 wrote to memory of 308 1244 NB4wr66jY4.exe 86 PID 1244 wrote to memory of 308 1244 NB4wr66jY4.exe 86 PID 1244 wrote to memory of 308 1244 NB4wr66jY4.exe 86 PID 4372 wrote to memory of 1780 4372 2xek.exe 85 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 1088 4372 2xek.exe 87 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 3128 4372 2xek.exe 90 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4380 4372 2xek.exe 91 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 4372 wrote to memory of 4788 4372 2xek.exe 92 PID 1984 wrote to memory of 4504 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 93 PID 1984 wrote to memory of 4504 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 93 PID 1984 wrote to memory of 4504 1984 a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe 93 PID 308 wrote to memory of 3848 308 cmd.exe 94 PID 308 wrote to memory of 3848 308 cmd.exe 94 PID 308 wrote to memory of 3848 308 cmd.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94 PID 4360 wrote to memory of 3848 4360 yzguj.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:752 -
C:\Users\Admin\AppData\Local\Temp\a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe"C:\Users\Admin\AppData\Local\Temp\a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\yzguj.exe"C:\Users\Admin\yzguj.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
-
-
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
PID:1780
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1088
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
PID:3128
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380
-
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
-
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Users\Admin\AppData\Local\94128f3e\X*0*bc*5ec283bb*31.193.3.240:534⤵
- Executes dropped EXE
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del a549c31c9f8dd7d11dfa3b9b3ff12c293ed6a5f3e735d9c6578f07f9153b0fc3.exe3⤵PID:1320
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1780 -ip 17801⤵PID:2916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
164KB
MD5c94ab34868ec4624e1e7e95e234a48ed
SHA1b419f37f2fabdac6598cf59fbc505de59a51de77
SHA2569772234bc94afb938998bf85c318dc800223993125e5ffa8dbe44a667ca71897
SHA512e2f602193c89ec094956e427dbf586fc1f39c0c329067f140c0af6b21cdc080138f717721b83eae1315adbe78de12107903438c8153deaf93f319ebb265b74e5
-
Filesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
Filesize
251KB
MD52ce19a9f18fc524fe115603b4ad9b9aa
SHA130b4c119d4b915826b020b12b7a6d5c7c5fd3c0e
SHA2566fbf9cc7aea0d80f7706603a0b8b11938a9a0e34557adb18b711d08cec13d7a3
SHA512c060d4c01799b6bd51947534359547c394d7f412d8edf2f3b3c6ac33ac13b66eee9503495cc5997ec9a4df162518422a5f4e13d75fe274baee1580d8e6a752b6
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
Filesize
224KB
MD55f3f430c5d00e2a2e4e1aae0e09078b9
SHA148a6be11c16e694c42fa0a0d05783177ba1c4adb
SHA256b1799329b5f9bffacf98c4d5542dc7e1b4021e6b3b0970bc1aec0f6094e0d867
SHA5123a41d2084d82a4aaeb6136c629f4dd84a813759570b3ffea2856e3358c2fb11fa19c4c6c5924f78cb0d1e297c7f928ecf4c019cafee15e1aa3fefa3eb05b0873
-
Filesize
224KB
MD5349512e6112c85456b8eee39764987e3
SHA14efb00f780b14b09a19ba5d6b2cc1ac6f961b4b4
SHA256f446c4efa91d87bf29b876c38927697a51f9d0e885b09598f2ff2057450742ef
SHA5128f8fd19239d124393245f3285bb4c883a0c86e19cb56733a7ba94da3b2f091fb72e92e4b03e6f1cb7f679afe45d28df8d2a5288b9cdd2c7312153185cc990af2
-
Filesize
224KB
MD5349512e6112c85456b8eee39764987e3
SHA14efb00f780b14b09a19ba5d6b2cc1ac6f961b4b4
SHA256f446c4efa91d87bf29b876c38927697a51f9d0e885b09598f2ff2057450742ef
SHA5128f8fd19239d124393245f3285bb4c883a0c86e19cb56733a7ba94da3b2f091fb72e92e4b03e6f1cb7f679afe45d28df8d2a5288b9cdd2c7312153185cc990af2