Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2023, 13:35
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\NDF\{21E62121-5B66-4244-A387-703E29CF6F42}-temp-05162023-1537.etl svchost.exe File opened for modification C:\Windows\system32\NDF\{21E62121-5B66-4244-A387-703E29CF6F42}-temp-05162023-1537.etl svchost.exe File opened for modification C:\Windows\system32\SRU\SRU.chk svchost.exe File opened for modification C:\Windows\system32\SRU\SRU.log svchost.exe File opened for modification C:\Windows\system32\SRU\SRUDB.dat svchost.exe File opened for modification C:\Windows\system32\SRU\SRUDB.jfm svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1840 ipconfig.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006b1b24209a5b3c4ab603530fd8f378dc00000000020000000000106600000001000020000000bf89d54cf74a1857e3839c31c560886104659dcc32dbd80aac28f4415f14f1db000000000e80000000020000200000001e7bcb3765decd3309885f9d6e5819b85d5aab84ba4d0b2a5e6d0a5259d3677120000000f33ddf07a5ba6ca62e6d0ef552c9d241156ec511ef603433ac3878038d97f4ec40000000463740d7b967f78f30d502e3b6f21ed2749473c73b61f4783347db1514d2abd39ace233a7608bbe6556703a15a7ea298c6cef03b9b2bae17db9ceec5bbb611c7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033356" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "796359871" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5AF6BEC7-F3FF-11ED-9156-42C2EBB090FB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006b1b24209a5b3c4ab603530fd8f378dc00000000020000000000106600000001000020000000f386abeeffd428f3da04af69276bc4979940565a17bceeb2d184fe36da351561000000000e8000000002000020000000756ac4b37b53c301505fe46469bfaff4c1d293f7db9e214dfe911b2d60107dc02000000032df93c3406c7cfab9c1256728f0ca67fe8a45608d640e0a52f2a4b87dc91aa0400000002d93acb823ea8e66f03583bca8fc3b23b4d00e3b3135dbb0bfe71688aaef7817ade1dba9e3c741ab08facd903950a9cfba63901b669325a282b45dc867572eb1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31033356" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7089715c0c88d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05d99310c88d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006b1b24209a5b3c4ab603530fd8f378dc00000000020000000000106600000001000020000000d4f86e364bd5e16cc22af5e8ab5e057eea773a912869d92393638347acf63385000000000e80000000020000200000006ed8e88bdef2ed85f55812038a48f91be457497a9f3be77cef520af33aa08c16200000007d549c5f61491c35d5527a9e56ab0df56a295d5171754aec23dc01c8d56e33b74000000061a814076d659cdb8b34dccf48d4e095a7454647735dc2478e460b24df42823a50fee048da664a0e46e0d066e3d0908e213d3c6471a94578e5d4a5fd3fa2b99f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://google.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20236a650c88d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31033356" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" msdt.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0035e3630c88d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "796359871" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30467f310c88d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync msdt.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "807453661" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006b1b24209a5b3c4ab603530fd8f378dc0000000002000000000010660000000100002000000073a32a4793fe7df46b5a773f94daac3ec1b2902c1513a08139318f46a28639ef000000000e80000000020000200000001ea132d742f6943c115bdd4b82dc48b36534dd75b8e31ff216dacef659f87264200000007b9a46e6c453abec6387950f15db5d390c919d051b29c8a3934e6804e38f37ed4000000032aea47075334e4640f20625e254c68283651fa4f0abfd009657e297bd8b62d484e816b8c172305cd44b28c03dd4e7aa0cf3070a9b1086c101913ad6c8b1e494 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" msdt.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391016334" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch msdt.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 46574c630c88d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006b1b24209a5b3c4ab603530fd8f378dc00000000020000000000106600000001000020000000c392ac44ee5dd5f933497bad70fc7e741d782f64c09a4af730e5741cdced45e8000000000e800000000200002000000083e2e322387e8d192dd6c81e05eef97f56ac98650abf04a9cedd4edd432aafb920000000c098d5f4d7983fb57c54075038dc71294fd92ad0f141ce6ad38646e2db1961e04000000045225926360198e99a9d271e38129660e9ad6288c6e35b43b8db7f937b9f063fde046a13c4263d9d8e993580092e31c5564951af8bdae1e5291cb3313b3f0a19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2548970870-3691742953-3895070203-1000\{588DE4CD-D626-441B-B1DD-3E477E4B1EFB} IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4556 sdiagnhost.exe 3068 svchost.exe 3068 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4556 sdiagnhost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1864 iexplore.exe 3860 msdt.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1864 iexplore.exe 1864 iexplore.exe 5100 IEXPLORE.EXE 5100 IEXPLORE.EXE 5100 IEXPLORE.EXE 5100 IEXPLORE.EXE 3860 msdt.exe 3860 msdt.exe 3860 msdt.exe 1864 iexplore.exe 5100 IEXPLORE.EXE 5100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1864 wrote to memory of 5100 1864 iexplore.exe 82 PID 1864 wrote to memory of 5100 1864 iexplore.exe 82 PID 1864 wrote to memory of 5100 1864 iexplore.exe 82 PID 5100 wrote to memory of 3860 5100 IEXPLORE.EXE 86 PID 5100 wrote to memory of 3860 5100 IEXPLORE.EXE 86 PID 5100 wrote to memory of 3860 5100 IEXPLORE.EXE 86 PID 4556 wrote to memory of 1732 4556 sdiagnhost.exe 93 PID 4556 wrote to memory of 1732 4556 sdiagnhost.exe 93 PID 4556 wrote to memory of 1732 4556 sdiagnhost.exe 93 PID 4556 wrote to memory of 1104 4556 sdiagnhost.exe 99 PID 4556 wrote to memory of 1104 4556 sdiagnhost.exe 99 PID 4556 wrote to memory of 1104 4556 sdiagnhost.exe 99 PID 4556 wrote to memory of 1840 4556 sdiagnhost.exe 102 PID 4556 wrote to memory of 1840 4556 sdiagnhost.exe 102 PID 4556 wrote to memory of 1840 4556 sdiagnhost.exe 102 PID 4556 wrote to memory of 2256 4556 sdiagnhost.exe 103 PID 4556 wrote to memory of 2256 4556 sdiagnhost.exe 103 PID 4556 wrote to memory of 2256 4556 sdiagnhost.exe 103 PID 4556 wrote to memory of 1124 4556 sdiagnhost.exe 104 PID 4556 wrote to memory of 1124 4556 sdiagnhost.exe 104 PID 4556 wrote to memory of 1124 4556 sdiagnhost.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://clearygotllieb.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\msdt.exe-modal "589896" -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFF225.tmp" -ep "NetworkDiagnosticsWeb"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
C:\Windows\SysWOW64\sdiagnhost.exeC:\Windows\SysWOW64\sdiagnhost.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter2⤵PID:1732
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter2⤵PID:1104
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /all2⤵
- Gathers network information
PID:1840
-
-
C:\Windows\SysWOW64\ROUTE.EXE"C:\Windows\system32\ROUTE.EXE" print2⤵PID:2256
-
-
C:\Windows\SysWOW64\makecab.exe"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddf2⤵PID:1124
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost1⤵
- Drops file in System32 directory
PID:4132 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\winethc.dll",ForceProxyDetectionOnNextRun2⤵PID:1016
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost1⤵PID:4744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize1KB
MD5bb7ed8e72178881dfc4cd2d867e311d6
SHA1dbbfe02cf805856431aaf56388aa175c27575eae
SHA256b43c773b7b271cc02da9727461011217519b15d3c6af43d02ca22718e5b975df
SHA512e47cacc1eec70c85fa09d9b8e0220fbf3e6ba683343c2dbcc0e1bf3a0e312021eb7d9f807dd631235c832f611b3d6252bc8a290d315ae8243ace64caadd19050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD559077241ce0ac9ac8eb9b9310aad1952
SHA1e55ab1ccbe4d6b0c3cdabf5b8b7b06a2957e05b8
SHA2565ac8fd637c49c033c7f208265b0323fb9a626767da12d460b9d550e4bcb92399
SHA5123b603aa5ddcb00830d46c4eae716f9b4e2493729a21cc6be0d257046ef23f78882446f84aac06572c0cf9a10da0f89897fda8bba078046b84fecd8d6992f59a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
Filesize446B
MD5a143a9590dc78f34fcea4361d7144629
SHA196b96a28ae0b5a8f8f02ac76a90174d5d2be8e04
SHA2567752460260ee61b205bd7c5175e87c63fa1ba5f2f80a9ad1f27636c47c0e4937
SHA512fb9381bfac6322e19ce611a707b4a024bab1b6c80a317ed8c21b4f9f26143a1a3aba7edd3efa468722bded3aba0c4e34d760109226dccaa8a35f7170b662c2f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD59c7ff9c832d24bae5b37910926d5ce3d
SHA1a2dcd7f65c3729b4d6aecd37003b5c1446cfad9d
SHA256042fc113c001acd896d7a240f00eabd3d161cabf14780c06ccc8d20c99a2fc82
SHA5122e6beb63871881db12318522ed6e9d50f8e4d70e3abd5b8f2d826117be20cc5060f0f82b589fa18973729dbea4a6b667cb0a1c4a10be7c07962ea7f884ff9b95
-
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2023051615.000\NetworkDiagnostics.debugreport.xml
Filesize137KB
MD5a10f60e366cafc3e2cd4afc6af58327c
SHA13f33df0fb14a4197cf09641f51d1e3a0519f2b7f
SHA256ed3f522a0e45015323840f98cc192c8afebd0e46e78e94375edb7d7ec6c72245
SHA51290bf9a43000b133291b3e49fb154fb75e69788c2874142eb65a83149db371973dd400160cffc7f2cc8824c1bf08fc16de00d8d64ac7d231801fc45e628c55153
-
Filesize
37KB
MD58ac223afd9cbfe49e2d736d9258d43a1
SHA1e5b5e1a52fa4db21b57e817508768917df06352f
SHA2564fd3a7cad190ddf83e2be38945ac4b2974bb178e1413d0dca937a1134ab2db9d
SHA5121b2903d780ffbc33f4d4a61390a937c11b06c3b9a62f65b2282907fb77e5642f84189a2a8a161575505c39a382a266a5063afd38620da6924ec7a33fae448b1d
-
Filesize
47KB
MD5310e1da2344ba6ca96666fb639840ea9
SHA1e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA25667401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
SHA51262ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
-
Filesize
5KB
MD571bbb44394b878af4d5f59ebd4e24bd1
SHA14f28f13919956d64b4687e4dab0dd1fd80ddb914
SHA256311fa11587469fce13d7bf4dad7fd4450dd31adc0783a1636a59d31842ce3272
SHA51227836712b00196dae1381bbbc2204b530aff7c3b8bdafe7cca2da1641d97d9bd450fdcd7e9d6cfd67e37e4fe1cdb14f77975bda6dc43cccb5e0766337640b1fb
-
Filesize
11KB
MD5742a84710384b55c3c6fbd71507a2a7a
SHA179ccbeed72dc0cad381e7644ba02ec23658f69bf
SHA256b8e3e3b2b16f71ee30150bea396334756ddb6d046a0e26ac47e428a1ab96eca6
SHA5128976b3ca4896b9df03ea62a698389e52db8cfee231632a521061327312447485f1c4bb702e1ca0e2ed7eeb5f59ac79f336e0ad57c2bca1ed1dce2e8c781df93a
-
Filesize
192KB
MD5be94e8d18efdbf53cf83194e045439e1
SHA1c8edcae5a99cd372cb1761d1b378563f31c28f64
SHA25606a1a1ea3a3e187bed574d132c0ac1c70242652b2dd1ca01e8f32a3ae5b01473
SHA512fe791b756824fe2bee6698ccd4528039444558afbb9efe67500780fcb5ee636437176e880d4c10165376b88176cf49c7c3cd8fddb00fe681fcaafd2da1575720
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JXO1ZP0L\4UabrENHsxJlGDuGo1OIlLU94YtzCwA[1].woff
Filesize25KB
MD5142cad8531b3c073b7a3ca9c5d6a1422
SHA1a33b906ecf28d62efe4941521fda567c2b417e4e
SHA256f8f2046a2847f22383616cf8a53620e6cecdd29cf2b6044a72688c11370b2ff8
SHA512ed9c3eebe1807447529b7e45b4ace3f0890c45695ba04cccb8a83c3063c033b4b52fa62b0621c06ea781bbea20bc004e83d82c42f04bb68fd6314945339df24a
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
19KB
MD5bafb105baeb22d965c70fe52ba6b49d9
SHA1934014cc9bbe5883542be756b3146c05844b254f
SHA2561570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed
SHA51285a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64
-
Filesize
3KB
MD5631fb53d2907b88b77fe88b2ce44269f
SHA1cf6d2f3e36fd5d563162f351204447885b6e02ef
SHA2563209e5fc477ae7d6f1d16b4f118e922ee2132ed0e30d704850e810ee9de097b7
SHA51210a24ded41c8f6221748010e27934bdfe1e6a25ad744b1fa4b511874333fe346c4692c7a09bbad9d2e6b45e69ae2f890a8dd1856bd4b0600915123eb5156c8d0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50d39d6ba850612a020302f334242a9b8
SHA125140746f3a1aa3a4c132e61d0ef578c2f4c04cd
SHA256b9871b8016b352130a004a5aa8c6c6548f2d350e75ff421b22c517495bc6514e
SHA5128ab543f5b3fe38aa3de860332deb3f395b15aff6731ef03fe706a4b5bbb31cc8f944bc8acd54830e6e0cef8f7f9bb7b203ca47b73551745512cb80d78c5281b3
-
Filesize
231B
MD500848049d4218c485d9e9d7a54aa3b5f
SHA1d1d5f388221417985c365e8acaec127b971c40d0
SHA256ffeafbb8e7163fd7ec9abc029076796c73cd7b4eddaeeda9ba394c547419769e
SHA5123a4874a5289682e2b32108740feea586cb9ccdad9ca08bf30f67c9742370c081ad943ea714f08dbf722f9f98f3b0bb307619a8ba47f96b24301c68b0fd1086d9
-
Filesize
1KB
MD54425a0072cd74fd7e9a0fd3f11758697
SHA1e68811ca274b17b59d40caee49a723fc98b22121
SHA2566e5b470ea84f49918b5cb087e58c34278750a2f012d1adbe2f75003442c17fdc
SHA512eee7302b7a3cb0ac3632251ccc2a03350c3ce62a70b98ada126d860de6df5976ed38f28665e9df9ac53a676e2c02eb072627370f1639ff13bc8e93afb71b4db0
-
Filesize
4KB
MD5670e92801738c11c8995429b451acc93
SHA16c33cb0e83aac898a5c6cf8a044e6863efeb4408
SHA25671539be7e39bf9b27d882e97b375745a1cab91854b04f6ddb546e98c8dc91710
SHA5128d28b823daa2ecddf135d09e42a9264bec09030c4232fec9e931660714a1059677a159379dad470c07b0f1007c347ba98630f2e369846421c063dd82a49e7d01
-
Filesize
978B
MD5a080ff06d4eeafbc870f1e3c42665c33
SHA1e5e712e3a13967f54793cf9a498ca1d2230eda6d
SHA2563bc5d9e3979c8e739270f729ae56ee33d468f8b8868ca16fe8b41812c012af37
SHA512831d26858bed5709c5760fdfd78f6122898f5220d59343cee1ef02dc36695b492cfbccb8b9f28886c13eac2e643ea5d1ac0faf88410e415de91e807ea8f893bc
-
Filesize
283B
MD537441c783fb6928329dc64c9702d53dd
SHA176ed4db3f7d0f95bfef1c2d504ab1041c324cc7c
SHA256b4902ff3f483cebf0fb08de36f6de3c86343222164c9eebbfa17d185711a57d8
SHA512a127a88653d262ca992ecc5a370a1a1b3b16ff9f41c71fdbfd50c3ec694ec73521d865c04eb522dff9b296004ef56d146edc1a3b50235ddfedf4041d38d03bd6
-
Filesize
25KB
MD5d0cfc204ca3968b891f7ce0dccfb2eda
SHA156dad1716554d8dc573d0ea391f808e7857b2206
SHA256e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
SHA5124d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
-
Filesize
567B
MD5a660422059d953c6d681b53a6977100e
SHA10c95dd05514d062354c0eecc9ae8d437123305bb
SHA256d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
SHA51226f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
-
Filesize
53KB
MD5c912faa190464ce7dec867464c35a8dc
SHA1d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA2563891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
SHA5125c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
-
Filesize
2KB
MD50c75ae5e75c3e181d13768909c8240ba
SHA1288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA256de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
SHA5128fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
-
Filesize
5KB
MD5380768979618b7097b0476179ec494ed
SHA1af2a03a17c546e4eeb896b230e4f2a52720545ab
SHA2560637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2
SHA512b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302
-
Filesize
478KB
MD5580dc3658fa3fe42c41c99c52a9ce6b0
SHA13c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA2565b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
SHA51268c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
-
Filesize
17KB
MD544c4385447d4fa46b407fc47c8a467d0
SHA141e4e0e83b74943f5c41648f263b832419c05256
SHA2568be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
SHA512191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
-
C:\Windows\Temp\SDIAG_a318556f-df37-44f0-b124-f122ad0b4241\result\21E62121-5B66-4244-A387-703E29CF6F42.Diagnose.Admin.0.etl
Filesize192KB
MD5be94e8d18efdbf53cf83194e045439e1
SHA1c8edcae5a99cd372cb1761d1b378563f31c28f64
SHA25606a1a1ea3a3e187bed574d132c0ac1c70242652b2dd1ca01e8f32a3ae5b01473
SHA512fe791b756824fe2bee6698ccd4528039444558afbb9efe67500780fcb5ee636437176e880d4c10165376b88176cf49c7c3cd8fddb00fe681fcaafd2da1575720
-
Filesize
1KB
MD50d39d6ba850612a020302f334242a9b8
SHA125140746f3a1aa3a4c132e61d0ef578c2f4c04cd
SHA256b9871b8016b352130a004a5aa8c6c6548f2d350e75ff421b22c517495bc6514e
SHA5128ab543f5b3fe38aa3de860332deb3f395b15aff6731ef03fe706a4b5bbb31cc8f944bc8acd54830e6e0cef8f7f9bb7b203ca47b73551745512cb80d78c5281b3