Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 11:52
Behavioral task
behavioral1
Sample
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
Resource
win10v2004-20230703-en
General
-
Target
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe
-
Size
5.8MB
-
MD5
dde5b7a0f954e8263b022811c3305866
-
SHA1
151ccc12e558bd3fb7a2014c25b75f052319f61e
-
SHA256
8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
-
SHA512
57b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
SSDEEP
98304:NTE6ZBd1H4f9dqvy6BockCIUS1OtWq+StwuowSLokM6VoA0DTtrlK58vGz+Tf4Ay:NT7LQ0ao8CIUCUWqFm11Q6Vo9thK/ziT
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2496 ÊÀ¼ÍÇéÔµ.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1332 ÊÀ¼ÍÇéÔµ.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1352 ÊÀ¼ÍÇéÔµ.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1008 ÊÀ¼ÍÇéÔµ.exe -
resource yara_rule behavioral1/memory/1080-54-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/1080-56-0x0000000000250000-0x000000000025B000-memory.dmp upx behavioral1/memory/1080-58-0x0000000000260000-0x000000000026B000-memory.dmp upx behavioral1/memory/1080-60-0x0000000000270000-0x0000000000278000-memory.dmp upx behavioral1/files/0x000100000000002d-84.dat upx behavioral1/memory/1080-86-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/1080-88-0x0000000000250000-0x000000000025B000-memory.dmp upx behavioral1/memory/1080-89-0x0000000000260000-0x000000000026B000-memory.dmp upx behavioral1/memory/2800-90-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/2800-92-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/2800-94-0x00000000002E0000-0x00000000002EB000-memory.dmp upx behavioral1/memory/2800-96-0x00000000002F0000-0x00000000002F8000-memory.dmp upx behavioral1/memory/2800-115-0x00000000002F0000-0x00000000002F8000-memory.dmp upx behavioral1/files/0x000100000000002d-122.dat upx behavioral1/memory/2800-124-0x0000000002DB0000-0x0000000002DC0000-memory.dmp upx behavioral1/files/0x000100000000002e-129.dat upx behavioral1/files/0x000100000000002e-132.dat upx behavioral1/memory/2800-133-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/2800-134-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/2496-137-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/memory/2800-138-0x00000000002E0000-0x00000000002EB000-memory.dmp upx behavioral1/memory/2496-139-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002e-142.dat upx behavioral1/memory/2800-144-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/2496-145-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002d-148.dat upx behavioral1/memory/2544-150-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/2544-155-0x0000000000260000-0x000000000026B000-memory.dmp upx behavioral1/memory/2800-199-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/2544-208-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/files/0x000100000000002e-217.dat upx behavioral1/memory/2544-218-0x0000000000250000-0x000000000025B000-memory.dmp upx behavioral1/memory/1332-222-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002e-225.dat upx behavioral1/memory/2544-224-0x0000000000270000-0x0000000000278000-memory.dmp upx behavioral1/memory/1332-229-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002d-231.dat upx behavioral1/memory/580-233-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/580-236-0x00000000003D0000-0x00000000003DB000-memory.dmp upx behavioral1/memory/580-238-0x00000000003E0000-0x00000000003EB000-memory.dmp upx behavioral1/memory/580-240-0x00000000003F0000-0x00000000003F8000-memory.dmp upx behavioral1/memory/2544-286-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/files/0x000100000000002e-303.dat upx behavioral1/memory/1352-305-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002e-307.dat upx behavioral1/memory/580-308-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/580-309-0x00000000003D0000-0x00000000003DB000-memory.dmp upx behavioral1/memory/580-313-0x00000000003F0000-0x00000000003F8000-memory.dmp upx behavioral1/memory/1352-315-0x0000000000400000-0x0000000000F72000-memory.dmp upx behavioral1/files/0x000100000000002d-317.dat upx behavioral1/memory/1644-318-0x0000000000400000-0x00000000010F0000-memory.dmp upx behavioral1/memory/1644-320-0x0000000000370000-0x000000000037B000-memory.dmp upx behavioral1/memory/1644-322-0x0000000000380000-0x000000000038B000-memory.dmp upx behavioral1/memory/1644-349-0x00000000003A0000-0x00000000003A8000-memory.dmp upx behavioral1/files/0x000100000000002e-388.dat upx behavioral1/files/0x000100000000002e-392.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\N: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\J: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\N: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Y: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\J: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\U: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\L: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\S: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\I: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\K: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\M: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\X: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Q: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\E: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\N: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\P: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\G: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\H: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\F: 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened (read-only) \??\Q: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\S: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\T: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\U: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\W: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\K: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\P: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\V: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\F: 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened (read-only) \??\H: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\K: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\O: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\F: 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened (read-only) \??\T: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\V: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\X: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\P: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\I: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\L: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\W: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\M: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\R: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\H: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\J: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\W: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Z: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\G: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\O: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Y: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\G: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\T: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Y: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Z: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\E: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\M: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Q: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\V: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\X: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\L: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\U: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\Z: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\F: 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened (read-only) \??\I: ÊÀ¼ÍÇéÔµ.exe File opened (read-only) \??\E: ÊÀ¼ÍÇéÔµ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened for modification \??\PhysicalDrive0 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened for modification \??\PhysicalDrive0 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe File opened for modification \??\PhysicalDrive0 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe Token: SeDebugPrivilege 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Suspicious use of FindShellTrayWindow 17 IoCs
pid Process 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2800 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 28 PID 1080 wrote to memory of 2800 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 28 PID 1080 wrote to memory of 2800 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 28 PID 1080 wrote to memory of 2800 1080 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 28 PID 2800 wrote to memory of 2496 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 30 PID 2800 wrote to memory of 2496 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 30 PID 2800 wrote to memory of 2496 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 30 PID 2800 wrote to memory of 2496 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 30 PID 2800 wrote to memory of 2544 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 34 PID 2800 wrote to memory of 2544 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 34 PID 2800 wrote to memory of 2544 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 34 PID 2800 wrote to memory of 2544 2800 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 34 PID 2544 wrote to memory of 1332 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 36 PID 2544 wrote to memory of 1332 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 36 PID 2544 wrote to memory of 1332 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 36 PID 2544 wrote to memory of 1332 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 36 PID 2544 wrote to memory of 580 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 37 PID 2544 wrote to memory of 580 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 37 PID 2544 wrote to memory of 580 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 37 PID 2544 wrote to memory of 580 2544 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 37 PID 580 wrote to memory of 1352 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 38 PID 580 wrote to memory of 1352 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 38 PID 580 wrote to memory of 1352 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 38 PID 580 wrote to memory of 1352 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 38 PID 580 wrote to memory of 1644 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 40 PID 580 wrote to memory of 1644 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 40 PID 580 wrote to memory of 1644 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 40 PID 580 wrote to memory of 1644 580 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 40 PID 1644 wrote to memory of 1008 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 42 PID 1644 wrote to memory of 1008 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 42 PID 1644 wrote to memory of 1008 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 42 PID 1644 wrote to memory of 1008 1644 8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"C:\Users\Admin\AppData\Local\Temp\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2496
-
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exeF:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"4⤵
- Executes dropped EXE
PID:1332
-
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exeF:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580 -
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"5⤵
- Executes dropped EXE
- Enumerates connected drives
PID:1352
-
-
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exeF:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\8f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"F:\ÊÀ¼ÍÇéÔµ(΢¶Ë)\ÊÀ¼ÍÇéÔµ.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
PID:1008
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
5.8MB
MD5dde5b7a0f954e8263b022811c3305866
SHA1151ccc12e558bd3fb7a2014c25b75f052319f61e
SHA2568f210ca742bd9e749e65db55e192b5bb6a88cf0935e1168a570f7f0f0ac012b3
SHA51257b7d08306880fb1121bf09f8e372be83606fded46e61fa749f8f907abf3fe960f96ebb404a562e0e83d63895a370a60836e63385542f9a904a87b7621ba7305
-
Filesize
53B
MD587b828f00e8a78f1d0b8c34d672b53a5
SHA1186c545bbd56a0086fbcf302dac6f7365676b087
SHA2567f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3
SHA51272cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc
-
Filesize
53B
MD587b828f00e8a78f1d0b8c34d672b53a5
SHA1186c545bbd56a0086fbcf302dac6f7365676b087
SHA2567f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3
SHA51272cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc
-
Filesize
53B
MD53b773fa1b0ff8685cad90d6b0bd580f0
SHA1df789a8b9570f6df9b4b74db60b8f5f081ab8030
SHA25607ccd166d5da19e9ce830836e875d78972ada3fbfe517f3b3bc3ef6caa2a4ad5
SHA5125a237020f05a7a1fdb32c3c6a79740e3f9f080af41f1746271ce7e6fa5df103f8527a02ba802307f08e8ac5732851e386779ee7aa050d311f3bd1680c3a0282f
-
Filesize
53B
MD587b828f00e8a78f1d0b8c34d672b53a5
SHA1186c545bbd56a0086fbcf302dac6f7365676b087
SHA2567f89dc9a76fd40ffd15196ca0fb37ac8fb49084fe3ea68f0a42cbd577177d1a3
SHA51272cd61df813e3f0f18daa95a70ec7313b520587c92eaa0af0cfb6b4512ebe0bf77975659ab06f36d3546c336f9bd36e36fd04a949112aefa652e22addccb08bc
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f
-
Filesize
4.5MB
MD5eb9d82eba00cb9f6f00ff1307974042e
SHA148040d87fe5febcd1e825aaacd8ae3a605f3bc19
SHA256c74ff188af2ca4b18378f7498a6aa7abd3d7062287d458cba0a83e63ff1c10dd
SHA51210e43340738260f197fa9e64a781f85d3109a1b7b24b0c3521d5ceb877a10f99d1b18a8de34ceb5d7665e67e212897708e062752c6f4f21894e3dae4d059ab4f