Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2023, 01:35
Static task
static1
General
-
Target
51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe
-
Size
1.1MB
-
MD5
261cba8b04f5c7b438362c932b73de73
-
SHA1
81eeb8473af6c6b8707b5e64649ea026fe0bd731
-
SHA256
51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed
-
SHA512
3f520e1e1ac502b4a035c94aea5fc370c81da5bcdf49d1d603e06b906305cd5f887a83a8fa5fb0028da6c59b7dad9cf4b0f8e9f30fea3e3459b409611a6603d1
-
SSDEEP
24576:0yghWl267Ue8vp1QSH6XiY2CCkg606A3QYQzkHNs7FhkiR/9I:Dn267U5p6SuVgVDAYQzS0Fhki9
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Extracted
vjw0rm
http://vj5566.duckdns.org:5566
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o8035148.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
WSHRAT payload 2 IoCs
resource yara_rule behavioral1/files/0x0004000000016966-275.dat family_wshrat behavioral1/files/0x000200000001e594-278.dat family_wshrat -
Blocklisted process makes network request 5 IoCs
flow pid Process 36 936 wscript.exe 37 936 wscript.exe 38 3212 wscript.exe 40 3212 wscript.exe 44 5056 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation windows.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation s8387374.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation legends.exe -
Executes dropped EXE 17 IoCs
pid Process 4084 z6618308.exe 1792 z2557362.exe 764 o8035148.exe 2788 p5716109.exe 3968 r2325718.exe 1888 r2325718.exe 4360 r2325718.exe 2252 s8387374.exe 564 s8387374.exe 3724 legends.exe 332 legends.exe 2644 legends.exe 4280 windows.exe 3972 legends.exe 2788 legends.exe 3440 legends.exe 4224 legends.exe -
Loads dropped DLL 1 IoCs
pid Process 924 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o8035148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o8035148.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z6618308.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z2557362.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6618308.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BXBCC2V24Z = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows.js\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2557362.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3968 set thread context of 4360 3968 r2325718.exe 96 PID 2252 set thread context of 564 2252 s8387374.exe 98 PID 3724 set thread context of 2644 3724 legends.exe 102 PID 3972 set thread context of 2788 3972 legends.exe 122 PID 3440 set thread context of 4224 3440 legends.exe 126 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3608 2788 WerFault.exe 90 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4612 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings wscript.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 37 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 38 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 40 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 764 o8035148.exe 764 o8035148.exe 4360 r2325718.exe 4360 r2325718.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 764 o8035148.exe Token: SeDebugPrivilege 3968 r2325718.exe Token: SeDebugPrivilege 2252 s8387374.exe Token: SeDebugPrivilege 3724 legends.exe Token: SeDebugPrivilege 4360 r2325718.exe Token: SeDebugPrivilege 3972 legends.exe Token: SeDebugPrivilege 3440 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 564 s8387374.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4084 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 84 PID 4840 wrote to memory of 4084 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 84 PID 4840 wrote to memory of 4084 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 84 PID 4084 wrote to memory of 1792 4084 z6618308.exe 85 PID 4084 wrote to memory of 1792 4084 z6618308.exe 85 PID 4084 wrote to memory of 1792 4084 z6618308.exe 85 PID 1792 wrote to memory of 764 1792 z2557362.exe 86 PID 1792 wrote to memory of 764 1792 z2557362.exe 86 PID 1792 wrote to memory of 764 1792 z2557362.exe 86 PID 1792 wrote to memory of 2788 1792 z2557362.exe 90 PID 1792 wrote to memory of 2788 1792 z2557362.exe 90 PID 1792 wrote to memory of 2788 1792 z2557362.exe 90 PID 4084 wrote to memory of 3968 4084 z6618308.exe 94 PID 4084 wrote to memory of 3968 4084 z6618308.exe 94 PID 4084 wrote to memory of 3968 4084 z6618308.exe 94 PID 3968 wrote to memory of 1888 3968 r2325718.exe 95 PID 3968 wrote to memory of 1888 3968 r2325718.exe 95 PID 3968 wrote to memory of 1888 3968 r2325718.exe 95 PID 3968 wrote to memory of 1888 3968 r2325718.exe 95 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 3968 wrote to memory of 4360 3968 r2325718.exe 96 PID 4840 wrote to memory of 2252 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 97 PID 4840 wrote to memory of 2252 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 97 PID 4840 wrote to memory of 2252 4840 51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe 97 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 2252 wrote to memory of 564 2252 s8387374.exe 98 PID 564 wrote to memory of 3724 564 s8387374.exe 99 PID 564 wrote to memory of 3724 564 s8387374.exe 99 PID 564 wrote to memory of 3724 564 s8387374.exe 99 PID 3724 wrote to memory of 332 3724 legends.exe 100 PID 3724 wrote to memory of 332 3724 legends.exe 100 PID 3724 wrote to memory of 332 3724 legends.exe 100 PID 3724 wrote to memory of 332 3724 legends.exe 100 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 3724 wrote to memory of 2644 3724 legends.exe 102 PID 2644 wrote to memory of 4612 2644 legends.exe 103 PID 2644 wrote to memory of 4612 2644 legends.exe 103 PID 2644 wrote to memory of 4612 2644 legends.exe 103 PID 2644 wrote to memory of 4884 2644 legends.exe 105 PID 2644 wrote to memory of 4884 2644 legends.exe 105 PID 2644 wrote to memory of 4884 2644 legends.exe 105 PID 4884 wrote to memory of 2692 4884 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe"C:\Users\Admin\AppData\Local\Temp\51312f97a220112c96448b8a2a3444873627bd82f4879c4c09bf4daf8aa7beed.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6618308.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2557362.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o8035148.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5716109.exe4⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 9285⤵
- Program crash
PID:3608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe4⤵
- Executes dropped EXE
PID:1888
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r2325718.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8387374.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Executes dropped EXE
PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
PID:4612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2692
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵PID:3184
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵PID:4588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1240
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵PID:3676
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵PID:3992
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\lRDdN.vbs"7⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
PID:936 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\lRDdN.vbs"8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:3212 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\windows.js"9⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:5056
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:924
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2788 -ip 27881⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:4224
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
961KB
MD5132717119df104381cae417f47d54204
SHA12a408be1c87cb38d5ec7ab29ace6bf29d9d9c254
SHA256578a3b8cde9f34033949ea03c66d99ead7b10e6d4a8ad408d60c8f0b4ee53d63
SHA5123aa1da87cb2de578c0e0ec0eef204672e9ee49aa8ca5280342101f24d3f630343447eb19d567a87a50def3c6ce069e4d8f07c5a3a6e48b1c48713243c2e474bc
-
Filesize
702KB
MD5df3dae35a70eebf04eabded60fcd7cef
SHA1fc46a7609383b27d363d7f42a4022951c044346f
SHA256c191e86e75f665e7f015ab08e30a1eddafe7f9b29ceb1e881f0ae494065d5ef3
SHA5125d0d0e4c7de0a8bc457b90306477de970832c72102edfba042d3cda0f6120e9d10d91c91bd203e7f742604ab078a82af62a89416a9bc31cf85ba53bfbf7dc1d9
-
Filesize
702KB
MD5df3dae35a70eebf04eabded60fcd7cef
SHA1fc46a7609383b27d363d7f42a4022951c044346f
SHA256c191e86e75f665e7f015ab08e30a1eddafe7f9b29ceb1e881f0ae494065d5ef3
SHA5125d0d0e4c7de0a8bc457b90306477de970832c72102edfba042d3cda0f6120e9d10d91c91bd203e7f742604ab078a82af62a89416a9bc31cf85ba53bfbf7dc1d9
-
Filesize
904KB
MD5eac44b63b88eb4a9113fa7acc07033b0
SHA102bcb3fd2b08dc45906760362492654f9044374d
SHA25644e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd
SHA5127a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1
-
Filesize
904KB
MD5eac44b63b88eb4a9113fa7acc07033b0
SHA102bcb3fd2b08dc45906760362492654f9044374d
SHA25644e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd
SHA5127a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1
-
Filesize
904KB
MD5eac44b63b88eb4a9113fa7acc07033b0
SHA102bcb3fd2b08dc45906760362492654f9044374d
SHA25644e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd
SHA5127a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1
-
Filesize
904KB
MD5eac44b63b88eb4a9113fa7acc07033b0
SHA102bcb3fd2b08dc45906760362492654f9044374d
SHA25644e06023252fc4960a191cec4969fc9e267c223c0b1bc4cf8a5ecdd0004f65fd
SHA5127a470b00baf5070e08b2959bf147509b5f00353b1547c582e40eb29a2e3834e190817a6feac0f9442cfcc1b91e07ebe6e0b2bc1d94393687b9d5b7177e37ebe1
-
Filesize
306KB
MD55c1dd91dc2f6e0b093826f6c8a6e604d
SHA1eb126938114ef44a9832cd93eb9b56060d91d201
SHA2563f0cbba45c7f377a38a5c9a1af7301d426070fc3ec293dea32f6d2e4b572f859
SHA5127c99a68d302e1cbd2be80a60d40ae075d218367f86e7c2294953050698c7790781c6f68f87d9ea77219c955f8e2f343efc2f84ded6233bb5d9069f11bb7a58f6
-
Filesize
306KB
MD55c1dd91dc2f6e0b093826f6c8a6e604d
SHA1eb126938114ef44a9832cd93eb9b56060d91d201
SHA2563f0cbba45c7f377a38a5c9a1af7301d426070fc3ec293dea32f6d2e4b572f859
SHA5127c99a68d302e1cbd2be80a60d40ae075d218367f86e7c2294953050698c7790781c6f68f87d9ea77219c955f8e2f343efc2f84ded6233bb5d9069f11bb7a58f6
-
Filesize
185KB
MD571291aab6f8e10ea2ff0fd5ef3b9199f
SHA110b960e4e02d056370c3e14b09fc1b79f147c0d6
SHA256c7a4baa43bf67e5cba2a8e7ca445767b33de0d727301b16e542d2d5dc58f8d47
SHA5124dbe68b38a152979a2e6fa2c7d83191b172568317313eb7a910ef5d8a9a3ced63ddf5fb28842b713b25fd84b0e0be5bdaea2c840465049709559a3f6f4edb98b
-
Filesize
185KB
MD571291aab6f8e10ea2ff0fd5ef3b9199f
SHA110b960e4e02d056370c3e14b09fc1b79f147c0d6
SHA256c7a4baa43bf67e5cba2a8e7ca445767b33de0d727301b16e542d2d5dc58f8d47
SHA5124dbe68b38a152979a2e6fa2c7d83191b172568317313eb7a910ef5d8a9a3ced63ddf5fb28842b713b25fd84b0e0be5bdaea2c840465049709559a3f6f4edb98b
-
Filesize
145KB
MD51c31e6d2ec968f1b3be0578280872ee7
SHA10831d5103ead173e5def572cc2817578c901e595
SHA2567b0a63106cdc93c3a1939f0e793e142e91c35873746079f8a203b6bfcfba59e9
SHA51261e137b620695a078e058ba0913dfbd587e8f09dd4610b791b45562b76083cf8ccdcf4a867c57aea9d3af30a56126e99b34b491959cce3c7516ad29320f5d4e7
-
Filesize
145KB
MD51c31e6d2ec968f1b3be0578280872ee7
SHA10831d5103ead173e5def572cc2817578c901e595
SHA2567b0a63106cdc93c3a1939f0e793e142e91c35873746079f8a203b6bfcfba59e9
SHA51261e137b620695a078e058ba0913dfbd587e8f09dd4610b791b45562b76083cf8ccdcf4a867c57aea9d3af30a56126e99b34b491959cce3c7516ad29320f5d4e7
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
Filesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
Filesize
3KB
MD514d1d9d3dc5e8d0eac04d5b78645a2ea
SHA1aa14b5a613919e41c4d97fef48ff1a24ff06fd2b
SHA25692d5609974d3d52dc028185e819111679f0ff052c1e3b951e2eee9b18e361f36
SHA512e13cc2ca8b4dc4564a2176e4bc06d2a3271a957918cb84589402462ea2fe33782eb92ab1575187ab07ac3e270e8301607bff6b7ccb1dd688666be940716f092c