Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2023, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe
Resource
win10v2004-20230220-en
General
-
Target
fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe
-
Size
1.1MB
-
MD5
7efcf50d722b6259120d33df12b5cbdd
-
SHA1
b1af7de0d8cb5748d87524ffea340c0c414c38a6
-
SHA256
fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c
-
SHA512
efd31ef9296271c4b5c0ecd954c53ee6b4a31c7b772ffe9fe11b0c65c6b45a70806b92ff8f63e4c346419d0189433013374dddbc01bf984ad91660e6f0b68cb5
-
SSDEEP
24576:UyHnLS2B41PUm8xwylQWaPxk2s2X3s9JINiO9UawWKx12rfpsttnLZ:jHLSD1PUfwYQXkR2X3Hr/wlXspstt
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Extracted
vjw0rm
http://vj5566.duckdns.org:5566
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o8403415.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o8403415.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o8403415.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o8403415.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o8403415.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o8403415.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
WSHRAT payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000022fcc-267.dat family_wshrat behavioral1/files/0x0006000000022fd0-270.dat family_wshrat -
Blocklisted process makes network request 7 IoCs
flow pid Process 27 4080 wscript.exe 29 4080 wscript.exe 31 2612 wscript.exe 32 2612 wscript.exe 34 648 WScript.exe 51 648 WScript.exe 58 648 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation s5656254.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation legends.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation windows.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 16 IoCs
pid Process 4224 z2571293.exe 2852 z5081621.exe 2104 o8403415.exe 4748 p9007021.exe 2436 r2990368.exe 4124 r2990368.exe 2024 s5656254.exe 1788 s5656254.exe 1984 legends.exe 1168 legends.exe 3436 legends.exe 2000 windows.exe 3252 legends.exe 3808 legends.exe 4960 legends.exe 844 legends.exe -
Loads dropped DLL 1 IoCs
pid Process 2184 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o8403415.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o8403415.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z2571293.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2571293.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z5081621.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5081621.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BXBCC2V24Z = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows.js\"" WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2436 set thread context of 4124 2436 r2990368.exe 96 PID 2024 set thread context of 1788 2024 s5656254.exe 101 PID 1984 set thread context of 3436 1984 legends.exe 105 PID 3252 set thread context of 3808 3252 legends.exe 118 PID 4960 set thread context of 844 4960 legends.exe 124 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3516 4748 WerFault.exe 91 4424 4124 WerFault.exe 96 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2948 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings wscript.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2104 o8403415.exe 2104 o8403415.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2104 o8403415.exe Token: SeDebugPrivilege 2436 r2990368.exe Token: SeDebugPrivilege 2024 s5656254.exe Token: SeDebugPrivilege 1984 legends.exe Token: SeDebugPrivilege 3252 legends.exe Token: SeDebugPrivilege 4960 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1788 s5656254.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4124 r2990368.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 4224 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 83 PID 1156 wrote to memory of 4224 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 83 PID 1156 wrote to memory of 4224 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 83 PID 4224 wrote to memory of 2852 4224 z2571293.exe 84 PID 4224 wrote to memory of 2852 4224 z2571293.exe 84 PID 4224 wrote to memory of 2852 4224 z2571293.exe 84 PID 2852 wrote to memory of 2104 2852 z5081621.exe 85 PID 2852 wrote to memory of 2104 2852 z5081621.exe 85 PID 2852 wrote to memory of 2104 2852 z5081621.exe 85 PID 2852 wrote to memory of 4748 2852 z5081621.exe 91 PID 2852 wrote to memory of 4748 2852 z5081621.exe 91 PID 2852 wrote to memory of 4748 2852 z5081621.exe 91 PID 4224 wrote to memory of 2436 4224 z2571293.exe 95 PID 4224 wrote to memory of 2436 4224 z2571293.exe 95 PID 4224 wrote to memory of 2436 4224 z2571293.exe 95 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 2436 wrote to memory of 4124 2436 r2990368.exe 96 PID 1156 wrote to memory of 2024 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 99 PID 1156 wrote to memory of 2024 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 99 PID 1156 wrote to memory of 2024 1156 fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe 99 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 2024 wrote to memory of 1788 2024 s5656254.exe 101 PID 1788 wrote to memory of 1984 1788 s5656254.exe 103 PID 1788 wrote to memory of 1984 1788 s5656254.exe 103 PID 1788 wrote to memory of 1984 1788 s5656254.exe 103 PID 1984 wrote to memory of 1168 1984 legends.exe 104 PID 1984 wrote to memory of 1168 1984 legends.exe 104 PID 1984 wrote to memory of 1168 1984 legends.exe 104 PID 1984 wrote to memory of 1168 1984 legends.exe 104 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 1984 wrote to memory of 3436 1984 legends.exe 105 PID 3436 wrote to memory of 2948 3436 legends.exe 106 PID 3436 wrote to memory of 2948 3436 legends.exe 106 PID 3436 wrote to memory of 2948 3436 legends.exe 106 PID 3436 wrote to memory of 5076 3436 legends.exe 108 PID 3436 wrote to memory of 5076 3436 legends.exe 108 PID 3436 wrote to memory of 5076 3436 legends.exe 108 PID 5076 wrote to memory of 4620 5076 cmd.exe 110 PID 5076 wrote to memory of 4620 5076 cmd.exe 110 PID 5076 wrote to memory of 4620 5076 cmd.exe 110 PID 5076 wrote to memory of 4948 5076 cmd.exe 111 PID 5076 wrote to memory of 4948 5076 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe"C:\Users\Admin\AppData\Local\Temp\fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2571293.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2571293.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5081621.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5081621.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8403415.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8403415.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9007021.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9007021.exe4⤵
- Executes dropped EXE
PID:4748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 9285⤵
- Program crash
PID:3516
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2990368.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2990368.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2990368.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2990368.exe4⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 125⤵
- Program crash
PID:4424
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5656254.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5656254.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5656254.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5656254.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Executes dropped EXE
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
PID:2948
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4620
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵PID:4948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵PID:4400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:5004
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵PID:436
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵PID:488
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
PID:2000 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\lRDdN.vbs"7⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
PID:4080 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\lRDdN.vbs"8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:2612 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\windows.js"9⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:648
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2184
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4748 -ip 47481⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4124 -ip 41241⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:844
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
961KB
MD5238ae5b81246d7b1cd01cf1eab2e88fb
SHA12315ee8ad08111f4dce9ab8e438ec179dfeab439
SHA2561a4d7c7ecca9d23730cac3393aeaa8250a1f41a611ee4ea0d5f3beecfbb74eb7
SHA51243d2d2d925fc20f289419f4bcde1df9499b4dc47e97e29917f6ef44f66f54dd186acff24bf328817d74439121b4b26e9ba5613d60115b6f7e80f5a0ffb407c15
-
Filesize
702KB
MD5644635a515aa584531dd87d2a84f6086
SHA14e81b83adf6c8c5fa179fc36a8e14c072b0e56a3
SHA256ce693faacf53e5784d1c8629c0f7e6b5b4895661fb70519e2d97e8c813f92453
SHA5129552274c61b1a3b117c8ca554a86267787300c0bf669ac9500293c88810f1c3c485e1ce1c2b25741a2c1fe72760e48c3d29b0976b7c4f1a9e79d1c938032c5d6
-
Filesize
702KB
MD5644635a515aa584531dd87d2a84f6086
SHA14e81b83adf6c8c5fa179fc36a8e14c072b0e56a3
SHA256ce693faacf53e5784d1c8629c0f7e6b5b4895661fb70519e2d97e8c813f92453
SHA5129552274c61b1a3b117c8ca554a86267787300c0bf669ac9500293c88810f1c3c485e1ce1c2b25741a2c1fe72760e48c3d29b0976b7c4f1a9e79d1c938032c5d6
-
Filesize
904KB
MD5ff7476a8a5499dd42310f0c69f6479a7
SHA1ce359ede5f78a2396bb828d25dec6b3510a3199b
SHA256b045878181b34f72ccfa32dcc8fc5226f56cc8262f6a53f8bd327a32872f0759
SHA512937bcb781ed152af1e63dbf72253ab17f70fee2e7b0a906901cdd4d20f3d12c176cd3d6e286c5e3a6006ade536a92d9b0d9476d571d6adb4ae104c9b485970dc
-
Filesize
904KB
MD5ff7476a8a5499dd42310f0c69f6479a7
SHA1ce359ede5f78a2396bb828d25dec6b3510a3199b
SHA256b045878181b34f72ccfa32dcc8fc5226f56cc8262f6a53f8bd327a32872f0759
SHA512937bcb781ed152af1e63dbf72253ab17f70fee2e7b0a906901cdd4d20f3d12c176cd3d6e286c5e3a6006ade536a92d9b0d9476d571d6adb4ae104c9b485970dc
-
Filesize
904KB
MD5ff7476a8a5499dd42310f0c69f6479a7
SHA1ce359ede5f78a2396bb828d25dec6b3510a3199b
SHA256b045878181b34f72ccfa32dcc8fc5226f56cc8262f6a53f8bd327a32872f0759
SHA512937bcb781ed152af1e63dbf72253ab17f70fee2e7b0a906901cdd4d20f3d12c176cd3d6e286c5e3a6006ade536a92d9b0d9476d571d6adb4ae104c9b485970dc
-
Filesize
306KB
MD5cc1e9ce41b6824fbfe80c60e3a602f16
SHA150a5f15faad1ed124521683d8acdefc7bde389a3
SHA256854e183c9ed25742be60b28a3103e77043958e01d81353102bb0f08f00c154b2
SHA51215b10e578526c19821faf36b1557c69188ca056ec5508bb14e7e7a78fc4467e92feeccddea76c725675fc1a2e57060499a6020dedad6ae0f95e0cc15a2103fba
-
Filesize
306KB
MD5cc1e9ce41b6824fbfe80c60e3a602f16
SHA150a5f15faad1ed124521683d8acdefc7bde389a3
SHA256854e183c9ed25742be60b28a3103e77043958e01d81353102bb0f08f00c154b2
SHA51215b10e578526c19821faf36b1557c69188ca056ec5508bb14e7e7a78fc4467e92feeccddea76c725675fc1a2e57060499a6020dedad6ae0f95e0cc15a2103fba
-
Filesize
185KB
MD5ada578b373b2348cd24a72a1b4d5a72d
SHA149dfbb816135cff2265df55cb2fa7e2f48d5a574
SHA256cb54b9473cba80e9d3f38a42ad00f1cbb19411163e0018790ef7c98235563aa1
SHA512550231a12e8e11b7818b538800389a960deda668e10c1b5e3e7d762dee4340f25603b7085a8c985452c0725ddcbe4228851468ed7fc465c9b870853dd6c41e31
-
Filesize
185KB
MD5ada578b373b2348cd24a72a1b4d5a72d
SHA149dfbb816135cff2265df55cb2fa7e2f48d5a574
SHA256cb54b9473cba80e9d3f38a42ad00f1cbb19411163e0018790ef7c98235563aa1
SHA512550231a12e8e11b7818b538800389a960deda668e10c1b5e3e7d762dee4340f25603b7085a8c985452c0725ddcbe4228851468ed7fc465c9b870853dd6c41e31
-
Filesize
145KB
MD594e3e35527bb6312f21ac9ef3fedc750
SHA1ee04792e7cb0be13e62dfcb1990f70b4cf690980
SHA256181320d3ea2684c6d216dad2825dad42afee2e699c6eaaeffb44e612fd98db2f
SHA512a1ab7c6af0ff46f1223e9180e32376268dab090de61c9fd70767a32816feba43e3e81856526eaa825e4fdd15b50aa698c5a8606e813756c73e762aaf1e1af372
-
Filesize
145KB
MD594e3e35527bb6312f21ac9ef3fedc750
SHA1ee04792e7cb0be13e62dfcb1990f70b4cf690980
SHA256181320d3ea2684c6d216dad2825dad42afee2e699c6eaaeffb44e612fd98db2f
SHA512a1ab7c6af0ff46f1223e9180e32376268dab090de61c9fd70767a32816feba43e3e81856526eaa825e4fdd15b50aa698c5a8606e813756c73e762aaf1e1af372
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
Filesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
Filesize
3KB
MD514d1d9d3dc5e8d0eac04d5b78645a2ea
SHA1aa14b5a613919e41c4d97fef48ff1a24ff06fd2b
SHA25692d5609974d3d52dc028185e819111679f0ff052c1e3b951e2eee9b18e361f36
SHA512e13cc2ca8b4dc4564a2176e4bc06d2a3271a957918cb84589402462ea2fe33782eb92ab1575187ab07ac3e270e8301607bff6b7ccb1dd688666be940716f092c