Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2023, 00:09
Static task
static1
Behavioral task
behavioral1
Sample
d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe
Resource
win10v2004-20230220-en
General
-
Target
d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe
-
Size
1.0MB
-
MD5
b0263760bf5ff8a38db7cc401763d269
-
SHA1
7518df3da9c6b396e758ee790722ba6cc6148437
-
SHA256
d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55
-
SHA512
b4c7a456a7a63f0795441162977377c286d512c04a745b4bad0fe6390b3e076a5103b0f6ae201da38771e29a0466a3aff55e944732fe308699649f4d998eedff
-
SSDEEP
12288:/MrDy90max4mx1CqdMI8Wum8gOs0SL1/+VZqMNQKxwAUL/0eWpC/DiN/27ncp+8O:Uy9ax/mNtW30K1/+/qMN/xwv0eU2rsO
Malware Config
Extracted
redline
lupa
83.97.73.126:19046
-
auth_value
6a764aa41830c77712442516d143bc9c
Extracted
redline
metro
83.97.73.126:19046
-
auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a
Extracted
vidar
4.1
c784f88cbd0064e2b88a2354266d33ad
https://steamcommunity.com/profiles/76561199510444991
https://t.me/task4manager
-
profile_id_v2
c784f88cbd0064e2b88a2354266d33ad
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 Edg/112.0.1722.34
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 16 IoCs
resource yara_rule behavioral1/memory/2824-269-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-270-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-273-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-275-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-277-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-279-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-281-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-284-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-286-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-288-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-291-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-298-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-294-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-303-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-307-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline behavioral1/memory/2824-310-0x0000000004F70000-0x0000000004FB2000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation s1879443.exe Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation legends.exe -
Executes dropped EXE 17 IoCs
pid Process 4484 z4829718.exe 1972 z7431170.exe 1092 o3002181.exe 4384 p9536417.exe 4104 r9080284.exe 4228 s1879443.exe 1312 s1879443.exe 4700 s1879443.exe 3236 legends.exe 3196 legends.exe 3012 a2592dx.exe 2824 a2592dx.exe 4152 setup.exe 4732 legends.exe 4996 legends.exe 2104 legends.exe 1900 legends.exe -
Loads dropped DLL 3 IoCs
pid Process 4348 AppLaunch.exe 4348 AppLaunch.exe 2952 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z4829718.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4829718.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z7431170.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7431170.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 1092 set thread context of 1952 1092 o3002181.exe 87 PID 4104 set thread context of 4788 4104 r9080284.exe 91 PID 4228 set thread context of 4700 4228 s1879443.exe 94 PID 3236 set thread context of 3196 3236 legends.exe 96 PID 3012 set thread context of 2824 3012 a2592dx.exe 109 PID 4152 set thread context of 4348 4152 setup.exe 112 PID 4732 set thread context of 4996 4732 legends.exe 116 PID 2104 set thread context of 1900 2104 legends.exe 119 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1696 4348 WerFault.exe 112 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AppLaunch.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1952 AppLaunch.exe 1952 AppLaunch.exe 4384 p9536417.exe 4384 p9536417.exe 4788 AppLaunch.exe 4788 AppLaunch.exe 4348 AppLaunch.exe 4348 AppLaunch.exe 2824 a2592dx.exe 2824 a2592dx.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1952 AppLaunch.exe Token: SeDebugPrivilege 4384 p9536417.exe Token: SeDebugPrivilege 4228 s1879443.exe Token: SeDebugPrivilege 4788 AppLaunch.exe Token: SeDebugPrivilege 3236 legends.exe Token: SeDebugPrivilege 2824 a2592dx.exe Token: SeDebugPrivilege 4732 legends.exe Token: SeDebugPrivilege 2104 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4700 s1879443.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 4484 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 83 PID 4124 wrote to memory of 4484 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 83 PID 4124 wrote to memory of 4484 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 83 PID 4484 wrote to memory of 1972 4484 z4829718.exe 84 PID 4484 wrote to memory of 1972 4484 z4829718.exe 84 PID 4484 wrote to memory of 1972 4484 z4829718.exe 84 PID 1972 wrote to memory of 1092 1972 z7431170.exe 85 PID 1972 wrote to memory of 1092 1972 z7431170.exe 85 PID 1972 wrote to memory of 1092 1972 z7431170.exe 85 PID 1092 wrote to memory of 1952 1092 o3002181.exe 87 PID 1092 wrote to memory of 1952 1092 o3002181.exe 87 PID 1092 wrote to memory of 1952 1092 o3002181.exe 87 PID 1092 wrote to memory of 1952 1092 o3002181.exe 87 PID 1092 wrote to memory of 1952 1092 o3002181.exe 87 PID 1972 wrote to memory of 4384 1972 z7431170.exe 88 PID 1972 wrote to memory of 4384 1972 z7431170.exe 88 PID 1972 wrote to memory of 4384 1972 z7431170.exe 88 PID 4484 wrote to memory of 4104 4484 z4829718.exe 89 PID 4484 wrote to memory of 4104 4484 z4829718.exe 89 PID 4484 wrote to memory of 4104 4484 z4829718.exe 89 PID 4104 wrote to memory of 4788 4104 r9080284.exe 91 PID 4104 wrote to memory of 4788 4104 r9080284.exe 91 PID 4104 wrote to memory of 4788 4104 r9080284.exe 91 PID 4104 wrote to memory of 4788 4104 r9080284.exe 91 PID 4104 wrote to memory of 4788 4104 r9080284.exe 91 PID 4124 wrote to memory of 4228 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 92 PID 4124 wrote to memory of 4228 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 92 PID 4124 wrote to memory of 4228 4124 d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe 92 PID 4228 wrote to memory of 1312 4228 s1879443.exe 93 PID 4228 wrote to memory of 1312 4228 s1879443.exe 93 PID 4228 wrote to memory of 1312 4228 s1879443.exe 93 PID 4228 wrote to memory of 1312 4228 s1879443.exe 93 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4228 wrote to memory of 4700 4228 s1879443.exe 94 PID 4700 wrote to memory of 3236 4700 s1879443.exe 95 PID 4700 wrote to memory of 3236 4700 s1879443.exe 95 PID 4700 wrote to memory of 3236 4700 s1879443.exe 95 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3236 wrote to memory of 3196 3236 legends.exe 96 PID 3196 wrote to memory of 4908 3196 legends.exe 97 PID 3196 wrote to memory of 4908 3196 legends.exe 97 PID 3196 wrote to memory of 4908 3196 legends.exe 97 PID 3196 wrote to memory of 884 3196 legends.exe 99 PID 3196 wrote to memory of 884 3196 legends.exe 99 PID 3196 wrote to memory of 884 3196 legends.exe 99 PID 884 wrote to memory of 1980 884 cmd.exe 101 PID 884 wrote to memory of 1980 884 cmd.exe 101 PID 884 wrote to memory of 1980 884 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe"C:\Users\Admin\AppData\Local\Temp\d3302b81a9086832df8cda2fb407f1a0bb0d78fa63cd08fbc83ce5c399a67a55.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4829718.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7431170.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o3002181.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9536417.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9080284.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe3⤵
- Executes dropped EXE
PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1879443.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
PID:4908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1980
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵PID:2092
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1548
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵PID:4456
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵PID:4280
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"C:\Users\Admin\AppData\Local\Temp\1000050001\a2592dx.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"C:\Users\Admin\AppData\Local\Temp\1000051001\setup.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4152 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"7⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 19208⤵
- Program crash
PID:1696
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2952
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4348 -ip 43481⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
PID:1900
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
369KB
MD58072726bf6f29230d619ec971b3d2a29
SHA1d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5
SHA256afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d
SHA512d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2
-
Filesize
369KB
MD58072726bf6f29230d619ec971b3d2a29
SHA1d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5
SHA256afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d
SHA512d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2
-
Filesize
369KB
MD58072726bf6f29230d619ec971b3d2a29
SHA1d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5
SHA256afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d
SHA512d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2
-
Filesize
369KB
MD58072726bf6f29230d619ec971b3d2a29
SHA1d1ae1b4ed834bf26d5ac06f01d55bbac8297e0b5
SHA256afbd589d3c919482f8d1e3b52c5fe9031522d20ed918362fc36796f1afe2822d
SHA512d20f66b8a1534076efc25977dd55a3badc7eaf7b9c4ccaca4915554247877927a3bb9ef20ad5d80fa60a550c5198c5b637c06acf899300c30504e52ec0145fa2
-
Filesize
483KB
MD50a7b50db665086a9588887b8d19f0ba5
SHA12d88b48091de92899a6c8d565f05d1587b2d2257
SHA256c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf
SHA51230a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965
-
Filesize
483KB
MD50a7b50db665086a9588887b8d19f0ba5
SHA12d88b48091de92899a6c8d565f05d1587b2d2257
SHA256c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf
SHA51230a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965
-
Filesize
483KB
MD50a7b50db665086a9588887b8d19f0ba5
SHA12d88b48091de92899a6c8d565f05d1587b2d2257
SHA256c100171736d5bc04a75a3570b7a32f9027290b593de87acf90fb01d48faab4bf
SHA51230a0fa9c52e6bf932b87c4fbf3edeac274d7503c1e325b8c5960d02f018e7ba1dc1cb20a0502765e508073a66bbe1f6c993e2a98bb523237a776b6d8c82fc965
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
965KB
MD50f0118725f7159936d4894499ffda94d
SHA1d380025750758ab8195c13c4a242bdffda68c8d6
SHA256705c29139fca14e769653ab073367c403bd3a27a68e46a41e7528937090e3448
SHA5129ed2de665ff27220c265d683d7839dc0bf8a45044f78c1c07c6bcbcfd98cbdcda0678a0fcdb79d891bfcbc09f3e9ffa47fcc8e7d59389e65c0808bc131c6a0e0
-
Filesize
621KB
MD5627958df7cbd2d98bf845b3e44bd5401
SHA15f921603afc325a97f5a79a4411a78e02f9ff4fc
SHA2568968d7edf4c3e66f71fb44fe041982d6b4860b9fbd7a54ff2d055a3fb84b7a8c
SHA512906d42df23e877df665f759fdf2e25251811343dc0b01f4cc3b9864cdfc3baee974fc98c9b6fbd15b8c7f5b161199f86d89e91f183ab413c0966b00b6c38eb0e
-
Filesize
621KB
MD5627958df7cbd2d98bf845b3e44bd5401
SHA15f921603afc325a97f5a79a4411a78e02f9ff4fc
SHA2568968d7edf4c3e66f71fb44fe041982d6b4860b9fbd7a54ff2d055a3fb84b7a8c
SHA512906d42df23e877df665f759fdf2e25251811343dc0b01f4cc3b9864cdfc3baee974fc98c9b6fbd15b8c7f5b161199f86d89e91f183ab413c0966b00b6c38eb0e
-
Filesize
322KB
MD531ba5b37f8b7f8a9cee8db5b63b6434f
SHA1114f4832c1316f00d27b898ce53568069cf6b413
SHA2568def11fd0af79539f6162c8bea9efefa6f4c41440a2ab08fd16cd419c383ca4b
SHA512179ec43acc454d1e5f27e0f01bb74815562b4c01b8b52e816230c23907614f3930ebb2b947ccd41693df6c3cf650f0fcccd2be9aaec81c0a45ed2acbe3ed4f72
-
Filesize
322KB
MD531ba5b37f8b7f8a9cee8db5b63b6434f
SHA1114f4832c1316f00d27b898ce53568069cf6b413
SHA2568def11fd0af79539f6162c8bea9efefa6f4c41440a2ab08fd16cd419c383ca4b
SHA512179ec43acc454d1e5f27e0f01bb74815562b4c01b8b52e816230c23907614f3930ebb2b947ccd41693df6c3cf650f0fcccd2be9aaec81c0a45ed2acbe3ed4f72
-
Filesize
283KB
MD591950f99edae34dab07face52368856e
SHA1243057137c16bb258880d0c5c858b1fdf09e2534
SHA256a1630456ec9c03b508379807249c53bbfd550b39ff23b8f3e1567ee74a208ce0
SHA512ae147086ec93f07211df1dc1208441098050dc86aa8baccf5b6dafb4d5f48d4d0970a404e1dbec5ea2279d2651a7cd1c4689b964aac39b9247c195d56aa0fb9e
-
Filesize
283KB
MD591950f99edae34dab07face52368856e
SHA1243057137c16bb258880d0c5c858b1fdf09e2534
SHA256a1630456ec9c03b508379807249c53bbfd550b39ff23b8f3e1567ee74a208ce0
SHA512ae147086ec93f07211df1dc1208441098050dc86aa8baccf5b6dafb4d5f48d4d0970a404e1dbec5ea2279d2651a7cd1c4689b964aac39b9247c195d56aa0fb9e
-
Filesize
166KB
MD5cb9d5bc5d0a9b24561c27ff22a2cbace
SHA13ca7048486c7e16a70be9fe2d634f1d1b57f0e22
SHA2560094504c03bfb4d8290368de7672e228e4790884390e4e88aa8f3184f900579d
SHA512271eee0d80751686eecb8f7f613c3ef7e0ae67c19dae8fcb19809fc1ad40b2e6d926b49ac4eecb8664cdb9aed9fbf81f99888dc3685a9ddcb0eb1850aa4d5284
-
Filesize
166KB
MD5cb9d5bc5d0a9b24561c27ff22a2cbace
SHA13ca7048486c7e16a70be9fe2d634f1d1b57f0e22
SHA2560094504c03bfb4d8290368de7672e228e4790884390e4e88aa8f3184f900579d
SHA512271eee0d80751686eecb8f7f613c3ef7e0ae67c19dae8fcb19809fc1ad40b2e6d926b49ac4eecb8664cdb9aed9fbf81f99888dc3685a9ddcb0eb1850aa4d5284
-
Filesize
168KB
MD5d8dadb5e9fc02553b2d6496ceb87f9ff
SHA1a80d109075b5814a22df91b65f1361c3788bac92
SHA256ac166525df3cd85fbf4487bf894b6d78574e8de85ea03bc8f8b20bbb55c4ccec
SHA512a96b9810fb6490f0b1ff74ea9a47b83175e2b537b828c2a9aeb14b3969f0b129a253947a4ed6ace647b1f1efd0180c2415cff9d99eca2e836ee929b61f92aae7
-
Filesize
168KB
MD5d8dadb5e9fc02553b2d6496ceb87f9ff
SHA1a80d109075b5814a22df91b65f1361c3788bac92
SHA256ac166525df3cd85fbf4487bf894b6d78574e8de85ea03bc8f8b20bbb55c4ccec
SHA512a96b9810fb6490f0b1ff74ea9a47b83175e2b537b828c2a9aeb14b3969f0b129a253947a4ed6ace647b1f1efd0180c2415cff9d99eca2e836ee929b61f92aae7
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5