Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/03/2023, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe
Resource
win10v2004-20230220-en
General
-
Target
88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe
-
Size
1.2MB
-
MD5
88e8bbeb8ff3e65cc5a8a562ad75ffb5
-
SHA1
3822798f280ebf79013934f5a34654f6cd0873a4
-
SHA256
ea5aa739b4e95d86b19d2f3a1f332cc56463093c93861e7386bcf3b8d651d6c5
-
SHA512
4c1084f131dd0337742cdd1e8aa13f535da77e51e22a0d7070a33c3ff10a743aeba1307de0842cebe43c4b8b4a39a6b0b0c13b07cb31ed6dd2634f40f0dfa725
-
SSDEEP
24576:ly3PDsJS0rBzX6e/Cf7lIY5/PofVlZNG/i3ldz0/+5VBYxrzlF659QA:A/AVrlqeQIY5/PofDjG61dz0WjBYFlF
Malware Config
Extracted
redline
rouch
193.56.146.11:4162
-
auth_value
1b1735bcfc122c708eae27ca352568de
Extracted
redline
durov
193.56.146.11:4162
-
auth_value
337984645d237df105d30aab7013119f
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" fuYh3814oA40.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" fuYh3814oA40.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" fuYh3814oA40.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" fuYh3814oA40.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" fuYh3814oA40.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
resource yara_rule behavioral1/memory/1276-113-0x0000000004940000-0x0000000004986000-memory.dmp family_redline behavioral1/memory/1276-114-0x0000000004980000-0x00000000049C4000-memory.dmp family_redline behavioral1/memory/1276-115-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-116-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-118-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-120-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-122-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-124-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-126-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-128-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-130-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-132-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-136-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-140-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-142-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-146-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-150-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-152-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-162-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-164-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-166-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-170-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-172-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-176-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-180-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-182-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-178-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-174-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-168-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-158-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-154-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-148-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-144-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-138-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-134-0x0000000004980000-0x00000000049BE000-memory.dmp family_redline behavioral1/memory/1276-1025-0x00000000047E0000-0x0000000004820000-memory.dmp family_redline behavioral1/memory/580-1992-0x0000000007060000-0x00000000070A0000-memory.dmp family_redline -
Executes dropped EXE 10 IoCs
pid Process 2012 plOs00nz87.exe 1980 plbN79sd52.exe 684 plfv82sQ41.exe 1628 plCK73Me70.exe 1716 buFF65ni99.exe 1276 caDg13XV42.exe 1288 dikP74Cb58.exe 580 esXR07Ek76.exe 952 fuYh3814oA40.exe 832 grzz30gY98.exe -
Loads dropped DLL 21 IoCs
pid Process 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 2012 plOs00nz87.exe 2012 plOs00nz87.exe 1980 plbN79sd52.exe 1980 plbN79sd52.exe 684 plfv82sQ41.exe 684 plfv82sQ41.exe 1628 plCK73Me70.exe 1628 plCK73Me70.exe 1628 plCK73Me70.exe 1628 plCK73Me70.exe 1276 caDg13XV42.exe 684 plfv82sQ41.exe 684 plfv82sQ41.exe 1288 dikP74Cb58.exe 1980 plbN79sd52.exe 1980 plbN79sd52.exe 580 esXR07Ek76.exe 2012 plOs00nz87.exe 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 832 grzz30gY98.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" dikP74Cb58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" fuYh3814oA40.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features buFF65ni99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" buFF65ni99.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" plOs00nz87.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce plfv82sQ41.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce plOs00nz87.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce plbN79sd52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" plbN79sd52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" plfv82sQ41.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce plCK73Me70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" plCK73Me70.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1716 buFF65ni99.exe 1716 buFF65ni99.exe 1276 caDg13XV42.exe 1276 caDg13XV42.exe 1288 dikP74Cb58.exe 1288 dikP74Cb58.exe 580 esXR07Ek76.exe 580 esXR07Ek76.exe 952 fuYh3814oA40.exe 952 fuYh3814oA40.exe 832 grzz30gY98.exe 832 grzz30gY98.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1716 buFF65ni99.exe Token: SeDebugPrivilege 1276 caDg13XV42.exe Token: SeDebugPrivilege 1288 dikP74Cb58.exe Token: SeDebugPrivilege 580 esXR07Ek76.exe Token: SeDebugPrivilege 952 fuYh3814oA40.exe Token: SeDebugPrivilege 832 grzz30gY98.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 1808 wrote to memory of 2012 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 28 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 2012 wrote to memory of 1980 2012 plOs00nz87.exe 29 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 1980 wrote to memory of 684 1980 plbN79sd52.exe 30 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 684 wrote to memory of 1628 684 plfv82sQ41.exe 31 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1716 1628 plCK73Me70.exe 32 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 1628 wrote to memory of 1276 1628 plCK73Me70.exe 33 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 684 wrote to memory of 1288 684 plfv82sQ41.exe 35 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 1980 wrote to memory of 580 1980 plbN79sd52.exe 36 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 2012 wrote to memory of 952 2012 plOs00nz87.exe 37 PID 1808 wrote to memory of 832 1808 88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe"C:\Users\Admin\AppData\Local\Temp\88e8bbeb8ff3e65cc5a8a562ad75ffb5.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plOs00nz87.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plOs00nz87.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plbN79sd52.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\plbN79sd52.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plfv82sQ41.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\plfv82sQ41.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plCK73Me70.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\plCK73Me70.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buFF65ni99.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\buFF65ni99.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caDg13XV42.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\caDg13XV42.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dikP74Cb58.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dikP74Cb58.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esXR07Ek76.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\esXR07Ek76.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuYh3814oA40.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fuYh3814oA40.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grzz30gY98.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grzz30gY98.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5f6543d1ce53f46e635276c5088b96cb3
SHA19c22399cf04965cb1ab9df254f91c2d8b89c7a69
SHA2564df90ca701f462414ebe4359c5c33e57e8ac066ebdea03056f0787cd51502acd
SHA5123b0726e2d26976e695ff750ee77856d6ea15478a53195f5c4397ae96eb70a49ebbd94c333336db25b0b355f3e7186a485c8e6f3d589c169482dc10e5597a9262
-
Filesize
175KB
MD5f6543d1ce53f46e635276c5088b96cb3
SHA19c22399cf04965cb1ab9df254f91c2d8b89c7a69
SHA2564df90ca701f462414ebe4359c5c33e57e8ac066ebdea03056f0787cd51502acd
SHA5123b0726e2d26976e695ff750ee77856d6ea15478a53195f5c4397ae96eb70a49ebbd94c333336db25b0b355f3e7186a485c8e6f3d589c169482dc10e5597a9262
-
Filesize
1.0MB
MD5698a89ee5c46a6f2c064e5c148770df8
SHA14674039892364129c89a7355c0d776fcb2a02419
SHA25614b81f7799d659f1a088b78d2e2976024ef25b93c82dc3a4ffda916b3b710282
SHA512bd69bc10a972e82c19aa056528db656641fbdc7d182919f0a92b3ae75ee7078cd6ab58cb3496b46f2708337c6c1f697192cbc39a3a77b8b29f5a34a47c43adfb
-
Filesize
1.0MB
MD5698a89ee5c46a6f2c064e5c148770df8
SHA14674039892364129c89a7355c0d776fcb2a02419
SHA25614b81f7799d659f1a088b78d2e2976024ef25b93c82dc3a4ffda916b3b710282
SHA512bd69bc10a972e82c19aa056528db656641fbdc7d182919f0a92b3ae75ee7078cd6ab58cb3496b46f2708337c6c1f697192cbc39a3a77b8b29f5a34a47c43adfb
-
Filesize
12KB
MD5acc823a93ba06b2d635b2721cf1a4e6a
SHA12e550893b05a450e3116886491ab90780cc24bf5
SHA25657e93ef3c759cc4b8f5f0c84f242022e4b58f1be8983c05a5648fac7aa44bef9
SHA5120c498043a8094c08fea22d91464d37fde1df2ff81ac47812200c0f346a72b87b801ecc9b8f61db157157908070be16018cec8d024e4e88bf0bdb292a4e43296f
-
Filesize
12KB
MD5acc823a93ba06b2d635b2721cf1a4e6a
SHA12e550893b05a450e3116886491ab90780cc24bf5
SHA25657e93ef3c759cc4b8f5f0c84f242022e4b58f1be8983c05a5648fac7aa44bef9
SHA5120c498043a8094c08fea22d91464d37fde1df2ff81ac47812200c0f346a72b87b801ecc9b8f61db157157908070be16018cec8d024e4e88bf0bdb292a4e43296f
-
Filesize
974KB
MD5339701300523e5f6cd671f41e0f2c927
SHA1439221018e96e49ff198dca4f2d83e8af4c264d2
SHA256189d616c3a2b1ae948e6855dbf9926296422a8d32ce52fc152284df574fbbd9f
SHA51295e7ca7caa00c9203f5a69618f3136444322b6d6d3ce95f9477e5c2b51558900cb15cd0fa403e0986514185ff03e8682a20137e9e3f18f4c1795cdc316a72f3f
-
Filesize
974KB
MD5339701300523e5f6cd671f41e0f2c927
SHA1439221018e96e49ff198dca4f2d83e8af4c264d2
SHA256189d616c3a2b1ae948e6855dbf9926296422a8d32ce52fc152284df574fbbd9f
SHA51295e7ca7caa00c9203f5a69618f3136444322b6d6d3ce95f9477e5c2b51558900cb15cd0fa403e0986514185ff03e8682a20137e9e3f18f4c1795cdc316a72f3f
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
692KB
MD58947420bc61793009c8e7637be84ffdb
SHA16c2597f01e05fe6f95a7fec817c65c0c42d9e4da
SHA256165c45a1e02f7b9cbaff45aebc7800935f30f449280cfe74f8718cb0abc50e64
SHA51216f5e131ec838bb26f795895f05c7ca299f5c642b2db7e6a2fc041543d9dfcbaba7d368e2265f9b02b366c929813b1fc73e5e7259cd9f856439b14f53e80b0e9
-
Filesize
692KB
MD58947420bc61793009c8e7637be84ffdb
SHA16c2597f01e05fe6f95a7fec817c65c0c42d9e4da
SHA256165c45a1e02f7b9cbaff45aebc7800935f30f449280cfe74f8718cb0abc50e64
SHA51216f5e131ec838bb26f795895f05c7ca299f5c642b2db7e6a2fc041543d9dfcbaba7d368e2265f9b02b366c929813b1fc73e5e7259cd9f856439b14f53e80b0e9
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
404KB
MD54a8fbd994d9b27b1933769bf8e8fd0d2
SHA1c61ed1fab7e527d448f6aa982695ba417559a723
SHA256e8b714171677de8b6af9d709c75ef9bfbdbc62148c14752d2acbfcd3800310ba
SHA5122ff572baed354c713ed81c92198c98fab783c6d397695144d58e4e2aa2ab45c6ea9f1eaacbc0a91deab3a470388076141c1d727e4af11b2cda4db7ded3752ea5
-
Filesize
404KB
MD54a8fbd994d9b27b1933769bf8e8fd0d2
SHA1c61ed1fab7e527d448f6aa982695ba417559a723
SHA256e8b714171677de8b6af9d709c75ef9bfbdbc62148c14752d2acbfcd3800310ba
SHA5122ff572baed354c713ed81c92198c98fab783c6d397695144d58e4e2aa2ab45c6ea9f1eaacbc0a91deab3a470388076141c1d727e4af11b2cda4db7ded3752ea5
-
Filesize
12KB
MD519ace7c4d1557e0d37599e2a35a58699
SHA15c0e14e7346cfacf48752802a3c57755eaa17265
SHA256bdae0fac56ee135b3e736fb6db8a9199e4c9de6e9dfc0dfb6889897bf1711de8
SHA512a88ee988989bbbe304d4b52869827e3d4521567f1daa8e5659bf9d48d416288d62628d1be1991bb9c0b29215aade16cff1b1a67bd231c5eb193843e94ba8ea87
-
Filesize
12KB
MD519ace7c4d1557e0d37599e2a35a58699
SHA15c0e14e7346cfacf48752802a3c57755eaa17265
SHA256bdae0fac56ee135b3e736fb6db8a9199e4c9de6e9dfc0dfb6889897bf1711de8
SHA512a88ee988989bbbe304d4b52869827e3d4521567f1daa8e5659bf9d48d416288d62628d1be1991bb9c0b29215aade16cff1b1a67bd231c5eb193843e94ba8ea87
-
Filesize
12KB
MD519ace7c4d1557e0d37599e2a35a58699
SHA15c0e14e7346cfacf48752802a3c57755eaa17265
SHA256bdae0fac56ee135b3e736fb6db8a9199e4c9de6e9dfc0dfb6889897bf1711de8
SHA512a88ee988989bbbe304d4b52869827e3d4521567f1daa8e5659bf9d48d416288d62628d1be1991bb9c0b29215aade16cff1b1a67bd231c5eb193843e94ba8ea87
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
175KB
MD5f6543d1ce53f46e635276c5088b96cb3
SHA19c22399cf04965cb1ab9df254f91c2d8b89c7a69
SHA2564df90ca701f462414ebe4359c5c33e57e8ac066ebdea03056f0787cd51502acd
SHA5123b0726e2d26976e695ff750ee77856d6ea15478a53195f5c4397ae96eb70a49ebbd94c333336db25b0b355f3e7186a485c8e6f3d589c169482dc10e5597a9262
-
Filesize
175KB
MD5f6543d1ce53f46e635276c5088b96cb3
SHA19c22399cf04965cb1ab9df254f91c2d8b89c7a69
SHA2564df90ca701f462414ebe4359c5c33e57e8ac066ebdea03056f0787cd51502acd
SHA5123b0726e2d26976e695ff750ee77856d6ea15478a53195f5c4397ae96eb70a49ebbd94c333336db25b0b355f3e7186a485c8e6f3d589c169482dc10e5597a9262
-
Filesize
1.0MB
MD5698a89ee5c46a6f2c064e5c148770df8
SHA14674039892364129c89a7355c0d776fcb2a02419
SHA25614b81f7799d659f1a088b78d2e2976024ef25b93c82dc3a4ffda916b3b710282
SHA512bd69bc10a972e82c19aa056528db656641fbdc7d182919f0a92b3ae75ee7078cd6ab58cb3496b46f2708337c6c1f697192cbc39a3a77b8b29f5a34a47c43adfb
-
Filesize
1.0MB
MD5698a89ee5c46a6f2c064e5c148770df8
SHA14674039892364129c89a7355c0d776fcb2a02419
SHA25614b81f7799d659f1a088b78d2e2976024ef25b93c82dc3a4ffda916b3b710282
SHA512bd69bc10a972e82c19aa056528db656641fbdc7d182919f0a92b3ae75ee7078cd6ab58cb3496b46f2708337c6c1f697192cbc39a3a77b8b29f5a34a47c43adfb
-
Filesize
12KB
MD5acc823a93ba06b2d635b2721cf1a4e6a
SHA12e550893b05a450e3116886491ab90780cc24bf5
SHA25657e93ef3c759cc4b8f5f0c84f242022e4b58f1be8983c05a5648fac7aa44bef9
SHA5120c498043a8094c08fea22d91464d37fde1df2ff81ac47812200c0f346a72b87b801ecc9b8f61db157157908070be16018cec8d024e4e88bf0bdb292a4e43296f
-
Filesize
974KB
MD5339701300523e5f6cd671f41e0f2c927
SHA1439221018e96e49ff198dca4f2d83e8af4c264d2
SHA256189d616c3a2b1ae948e6855dbf9926296422a8d32ce52fc152284df574fbbd9f
SHA51295e7ca7caa00c9203f5a69618f3136444322b6d6d3ce95f9477e5c2b51558900cb15cd0fa403e0986514185ff03e8682a20137e9e3f18f4c1795cdc316a72f3f
-
Filesize
974KB
MD5339701300523e5f6cd671f41e0f2c927
SHA1439221018e96e49ff198dca4f2d83e8af4c264d2
SHA256189d616c3a2b1ae948e6855dbf9926296422a8d32ce52fc152284df574fbbd9f
SHA51295e7ca7caa00c9203f5a69618f3136444322b6d6d3ce95f9477e5c2b51558900cb15cd0fa403e0986514185ff03e8682a20137e9e3f18f4c1795cdc316a72f3f
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
692KB
MD58947420bc61793009c8e7637be84ffdb
SHA16c2597f01e05fe6f95a7fec817c65c0c42d9e4da
SHA256165c45a1e02f7b9cbaff45aebc7800935f30f449280cfe74f8718cb0abc50e64
SHA51216f5e131ec838bb26f795895f05c7ca299f5c642b2db7e6a2fc041543d9dfcbaba7d368e2265f9b02b366c929813b1fc73e5e7259cd9f856439b14f53e80b0e9
-
Filesize
692KB
MD58947420bc61793009c8e7637be84ffdb
SHA16c2597f01e05fe6f95a7fec817c65c0c42d9e4da
SHA256165c45a1e02f7b9cbaff45aebc7800935f30f449280cfe74f8718cb0abc50e64
SHA51216f5e131ec838bb26f795895f05c7ca299f5c642b2db7e6a2fc041543d9dfcbaba7d368e2265f9b02b366c929813b1fc73e5e7259cd9f856439b14f53e80b0e9
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
323KB
MD5d63943fff34d970e9e0b3f75786ebb19
SHA1ae02c8c5e501ee6082690c891d76d7c8ed2b8d61
SHA2568737bbc6d4523a9630be3cc5456bee48ab25ae652c58de3627fc3579ca54bf87
SHA5128b9d252d2617486c40a04048558a5c01722b45350c5a8c7a2b0fd2816e0954464dfbc5ba5bfe63a5d052f5d0fa9b6ed915232d42259ab1d9a66e5b86576699a0
-
Filesize
404KB
MD54a8fbd994d9b27b1933769bf8e8fd0d2
SHA1c61ed1fab7e527d448f6aa982695ba417559a723
SHA256e8b714171677de8b6af9d709c75ef9bfbdbc62148c14752d2acbfcd3800310ba
SHA5122ff572baed354c713ed81c92198c98fab783c6d397695144d58e4e2aa2ab45c6ea9f1eaacbc0a91deab3a470388076141c1d727e4af11b2cda4db7ded3752ea5
-
Filesize
404KB
MD54a8fbd994d9b27b1933769bf8e8fd0d2
SHA1c61ed1fab7e527d448f6aa982695ba417559a723
SHA256e8b714171677de8b6af9d709c75ef9bfbdbc62148c14752d2acbfcd3800310ba
SHA5122ff572baed354c713ed81c92198c98fab783c6d397695144d58e4e2aa2ab45c6ea9f1eaacbc0a91deab3a470388076141c1d727e4af11b2cda4db7ded3752ea5
-
Filesize
12KB
MD519ace7c4d1557e0d37599e2a35a58699
SHA15c0e14e7346cfacf48752802a3c57755eaa17265
SHA256bdae0fac56ee135b3e736fb6db8a9199e4c9de6e9dfc0dfb6889897bf1711de8
SHA512a88ee988989bbbe304d4b52869827e3d4521567f1daa8e5659bf9d48d416288d62628d1be1991bb9c0b29215aade16cff1b1a67bd231c5eb193843e94ba8ea87
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d
-
Filesize
380KB
MD5a3da8951bb23f305fd251958e8535aa4
SHA1ef6115e81f6e8a5a7ed3428db8ff7e34619e7e54
SHA256786dcca370472e838015aaff2797f569f05b3fe168087a60e95294354ced715a
SHA512be73e7708641e3d8d8f3f7b9136287bdf4de58798dd98ba5b03d1e486ff97aafcba07f428d135c87cb84098595e711a64d72b3ec43100375049d49d88618fe9d