Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10MMLo7.Rat.rar
windows7-x64
7MMLo7.Rat.rar
windows10-1703-x64
7MMLo7.Rat.rar
windows10-2004-x64
10MMLo7 Rat.exe
windows7-x64
1MMLo7 Rat.exe
windows10-1703-x64
5MMLo7 Rat.exe
windows10-2004-x64
10turingmachine.exe
windows7-x64
1turingmachine.exe
windows10-1703-x64
5turingmachine.exe
windows10-2004-x64
10Analysis
-
max time kernel
276s -
max time network
281s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 10:15
Behavioral task
behavioral1
Sample
MMLo7.Rat.rar
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
MMLo7.Rat.rar
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
MMLo7.Rat.rar
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
MMLo7 Rat.exe
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
MMLo7 Rat.exe
Resource
win10-20230703-en
Behavioral task
behavioral6
Sample
MMLo7 Rat.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
turingmachine.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
turingmachine.exe
Resource
win10-20230703-en
General
-
Target
MMLo7.Rat.rar
-
Size
5.7MB
-
MD5
4747547f047d47bd37bc0d1b65625694
-
SHA1
827e3f9ca857ed95ef8185c80e5fa85fdffa28e4
-
SHA256
091833fb986ac8a78a9a33ae7852d2b02d510348bdcb915d4e2e51a6de27f64a
-
SHA512
3336de360626d125c4777d626a0790c69faf209c642d99d085cd72f92b9e5ba93aca9f9c92d81cb1e3b2ee21f6ff12cf9c6fe6ecbe9554ad846fa1cd74874241
-
SSDEEP
98304:HtkSjvhd8cMOBhzp1svAJFF5N7nicdRaDzmLW/nJHksov7iUsPIUDjvEQnQLligi:HtBjJd8vazEQFPN7tAeaBLNUsPIUvMUL
Malware Config
Extracted
xworm
-
install_file
USB.exe
Extracted
quasar
-
reconnect_delay
5000
Extracted
quasar
1.3.3.7
Office04
127.0.0.1:305
QSR_MUTEX_2Q0xuNOWuzstz1nIHm
-
encryption_key
yXJmgz868tgJWmotirHr
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 6 IoCs
resource yara_rule behavioral3/files/0x00060000000230cc-275.dat family_quasar behavioral3/files/0x000300000000073f-283.dat family_quasar behavioral3/files/0x000300000000073f-284.dat family_quasar behavioral3/memory/3144-285-0x0000000000DC0000-0x0000000000E2C000-memory.dmp family_quasar behavioral3/files/0x0003000000000743-294.dat family_quasar behavioral3/files/0x0003000000000743-295.dat family_quasar -
Executes dropped EXE 7 IoCs
pid Process 5036 MMLo7 Rat.exe 2340 Software.exe 4736 conhost.exe 2644 conhost.exe 3144 MMLo7-Trojan.exe 1232 Client.exe 4456 conhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 44 ip-api.com 63 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3184 schtasks.exe -
Modifies registry class 55 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Software.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Software.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell Software.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000 Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "4" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "5" Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c8b30e07acadd9019e0bdc0cacadd901ecf88d0eacadd90114000000 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff Software.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents" Software.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg Software.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Software.exe Set value (data) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff Software.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Software.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 4456 powershell.exe 4456 powershell.exe 2340 Software.exe 2340 Software.exe 2340 Software.exe 2340 Software.exe 2340 Software.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2340 Software.exe 3628 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeRestorePrivilege 2472 7zG.exe Token: 35 2472 7zG.exe Token: SeSecurityPrivilege 2472 7zG.exe Token: SeSecurityPrivilege 2472 7zG.exe Token: SeDebugPrivilege 5036 MMLo7 Rat.exe Token: SeDebugPrivilege 4456 powershell.exe Token: SeDebugPrivilege 2340 Software.exe Token: SeDebugPrivilege 4736 conhost.exe Token: SeDebugPrivilege 4736 conhost.exe Token: SeDebugPrivilege 2644 conhost.exe Token: SeDebugPrivilege 3144 MMLo7-Trojan.exe Token: SeDebugPrivilege 1232 Client.exe Token: SeDebugPrivilege 4456 conhost.exe Token: SeDebugPrivilege 3628 taskmgr.exe Token: SeSystemProfilePrivilege 3628 taskmgr.exe Token: SeCreateGlobalPrivilege 3628 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2472 7zG.exe 2340 Software.exe 2340 Software.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2340 Software.exe 2340 Software.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe 3628 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4928 OpenWith.exe 2340 Software.exe 2340 Software.exe 2340 Software.exe 2340 Software.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5036 wrote to memory of 2340 5036 MMLo7 Rat.exe 99 PID 5036 wrote to memory of 2340 5036 MMLo7 Rat.exe 99 PID 5036 wrote to memory of 4456 5036 MMLo7 Rat.exe 100 PID 5036 wrote to memory of 4456 5036 MMLo7 Rat.exe 100 PID 5036 wrote to memory of 4456 5036 MMLo7 Rat.exe 100 PID 5036 wrote to memory of 4736 5036 MMLo7 Rat.exe 102 PID 5036 wrote to memory of 4736 5036 MMLo7 Rat.exe 102 PID 4736 wrote to memory of 3184 4736 conhost.exe 103 PID 4736 wrote to memory of 3184 4736 conhost.exe 103 PID 3144 wrote to memory of 1232 3144 MMLo7-Trojan.exe 110 PID 3144 wrote to memory of 1232 3144 MMLo7-Trojan.exe 110 PID 3144 wrote to memory of 1232 3144 MMLo7-Trojan.exe 110
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat.rar1⤵
- Modifies registry class
PID:2080
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4928
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4632
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\" -spe -an -ai#7zMap15819:98:7zEvent154281⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2472
-
C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe"C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\Software.exe"C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\Software.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\conhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Users\Admin\AppData\Local\Temp\conhost.exe"C:\Users\Admin\AppData\Local\Temp\conhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "conhost" /tr "C:\ProgramData\conhost.exe"3⤵
- Creates scheduled task(s)
PID:3184
-
-
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
C:\Users\Admin\Desktop\MMLo7-Trojan.exe"C:\Users\Admin\Desktop\MMLo7-Trojan.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵PID:316
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
4.3MB
MD5068b4f05eb35479a419bc55da643781e
SHA11d0fe6bb23bbd63dc6d4248f7c17afcf4bc16dea
SHA256477ebd61ce116c6908a1cd1e50bc93869f6f7b9c3e0e5757551e6dd2a01b4648
SHA512f9022c7d91364519f5b773fd641741637f89a4f4f8eb1406d1c594e0a286724cea7494fb047e810bbed0579b6870db49a6828b1c79808e4554d762f326a87dcc
-
Filesize
2.8MB
MD52dc24c81438806bd03b492b9a3f3c55c
SHA11b62f6d53570d7cd3c8d04e6ea7e349b5de5cc89
SHA2563edd74d68dd78681ed9eae3973ee2fb878c60e6e24dfa313ea2b4547008b1149
SHA512f03ef03ffd926c35a6c88be065a8b6174af323a9fc633fc8d0c1ee55bf8b2eb5ef824d9c9feda21104dd10ff7f0d8d0660e9d4ba0cd8a932dd5d8e342f023ce1
-
Filesize
2.8MB
MD52dc24c81438806bd03b492b9a3f3c55c
SHA11b62f6d53570d7cd3c8d04e6ea7e349b5de5cc89
SHA2563edd74d68dd78681ed9eae3973ee2fb878c60e6e24dfa313ea2b4547008b1149
SHA512f03ef03ffd926c35a6c88be065a8b6174af323a9fc633fc8d0c1ee55bf8b2eb5ef824d9c9feda21104dd10ff7f0d8d0660e9d4ba0cd8a932dd5d8e342f023ce1
-
Filesize
161B
MD5c16b0746faa39818049fe38709a82c62
SHA13fa322fe6ed724b1bc4fd52795428a36b7b8c131
SHA256d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
SHA512cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
-
Filesize
277KB
MD58df4d6b5dc1629fcefcdc20210a88eac
SHA116c661757ad90eb84228aa3487db11a2eac6fe64
SHA2563e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e
SHA512874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174
-
Filesize
40KB
MD5bf929442b12d4b5f9906b29834bf7db1
SHA1810a2b3c8e548d1df931538bc304cc1405f7a32b
SHA256b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
SHA5129fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
-
Filesize
1016B
MD5804a72ca0e8d431d67ec1f1920d839cd
SHA12f3d22973e147a049ac87817d26ec13dcc959a2c
SHA256ebe8b86d9c5e1865a4d8ae9c7781a04a56e865bd5e5ffd114211191bae161497
SHA51207c5974f18be4769e9af00d2d5378c5a389be0b8ec4649b0dbd24b84643ab5aa322d0a68417e301795a49bc3dfef767668f6d8fc48178f521e99c51221393213
-
Filesize
5.0MB
MD5a03565cf42ca83d7494117d7e3cc82e4
SHA17a4bc05fe549484bd831c8f0397d7c1a0fe288c2
SHA256c8406d3bcc1ecf408d6f66991a711fb8bddd7ca48a5a3cb4144d7ba20e3754cf
SHA5123084c9df0e9e81746b67435e2f5653e5cc49f176df209112fc9b8de5340bd68fe6ed39a2cfd7fc50f2d4a7b33834c4530cf77754903f1036a6fdd9af5624fa3a
-
Filesize
5.0MB
MD5a03565cf42ca83d7494117d7e3cc82e4
SHA17a4bc05fe549484bd831c8f0397d7c1a0fe288c2
SHA256c8406d3bcc1ecf408d6f66991a711fb8bddd7ca48a5a3cb4144d7ba20e3754cf
SHA5123084c9df0e9e81746b67435e2f5653e5cc49f176df209112fc9b8de5340bd68fe6ed39a2cfd7fc50f2d4a7b33834c4530cf77754903f1036a6fdd9af5624fa3a
-
Filesize
5.0MB
MD5a03565cf42ca83d7494117d7e3cc82e4
SHA17a4bc05fe549484bd831c8f0397d7c1a0fe288c2
SHA256c8406d3bcc1ecf408d6f66991a711fb8bddd7ca48a5a3cb4144d7ba20e3754cf
SHA5123084c9df0e9e81746b67435e2f5653e5cc49f176df209112fc9b8de5340bd68fe6ed39a2cfd7fc50f2d4a7b33834c4530cf77754903f1036a6fdd9af5624fa3a
-
Filesize
76KB
MD564e9cb25aeefeeba3bb579fb1a5559bc
SHA1e719f80fcbd952609475f3d4a42aa578b2034624
SHA25634cab594ce9c9af8e12a6923fc16468f5b87e168777db4be2f04db883c1db993
SHA512b21cd93f010b345b09b771d24b2e5eeed3b73a82fc16badafea7f0324e39477b0d7033623923313d2de5513cb778428ae10161ae7fc0d6b00e446f8d89cf0f8c
-
Filesize
286KB
MD5c81a9adf64819041ac1435fab28004e3
SHA1a126d54caabbdd6456ac1ddd57a4ead629f4f287
SHA2565a1c7a22a6fbe36701b53b49a134ad37ab6194030753824a1bef260862902ac8
SHA5123ec5bc46bd46a06271905614adde9e60dd30d2315eb700d36852c6d2e1207a6218d007a7eb9ef2f0134eae53b1a04305be61e314e0ca426e132e8660e0bdcf58
-
Filesize
426B
MD508eaf0a087c3a7d35c1c0e50dd304cbd
SHA1e6f8463ad17ae7ef4b28b33ad6d6742791bfa628
SHA256f638d7332e5b55ac336f8f6f2692a3db9df3b51f95771720d923f4db439e3fdb
SHA512ccc6b132eebe3536671bff04fc6d7664abdfe5dd8022fa64bf6a678927791f39b55b7d890f210570378b16fb59dd219e216a979f7da2fec0b3814b05da95cd2c
-
Filesize
427B
MD5fc02b03164bba49b505046234efa9e8d
SHA126aaa4dc2e2f090ad574487cbf69c17e40898c52
SHA25625d3fd8a749be829ba0db17bbc9538fda71b9ac0f049d4355167783a63bb100e
SHA512d8c1d83ca46770b833daaef346e84ab23d98d4b342301fd4d67aac7eabf10cf2756319d09c076a985731296fefb8f85c22aa2ac7e2c0c941b124a94413c122fd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
64KB
MD54b08ce9062f3be1e89b4ad335e4b9fca
SHA1cf9dfe7d29227b52a1e54a1a119e2172fa5f6a0f
SHA2567ca9588bcfc058c3ae22caec75367fb4aae066d59b3411fd845b98e138d44dff
SHA5128d093eb5b996332522fbc379ab2811c98e084060d9797b2c156f402f82e5889fd2783abd74e8635801a6659b88bc8ff67231fa7ec24a7a85bdb78f2a15c31aab
-
Filesize
405KB
MD5d210d7aaeec5222740bce8da9a1ba195
SHA168219d51fbbaf26bf6ba5aa4598e4cf08f5ac702
SHA2567281b274d848f116141307f1b15c3c29eff71ef653508e1fa27f402925b77229
SHA512d27253dfff897bb7bed214c1a6749ea49c58fb847bfde84deb129babdf3f72ac187b191719ffbcd5aa93d2eb8eefbf697bd29667265af7edd67090142548e968
-
Filesize
405KB
MD5d210d7aaeec5222740bce8da9a1ba195
SHA168219d51fbbaf26bf6ba5aa4598e4cf08f5ac702
SHA2567281b274d848f116141307f1b15c3c29eff71ef653508e1fa27f402925b77229
SHA512d27253dfff897bb7bed214c1a6749ea49c58fb847bfde84deb129babdf3f72ac187b191719ffbcd5aa93d2eb8eefbf697bd29667265af7edd67090142548e968
-
Filesize
405KB
MD5d210d7aaeec5222740bce8da9a1ba195
SHA168219d51fbbaf26bf6ba5aa4598e4cf08f5ac702
SHA2567281b274d848f116141307f1b15c3c29eff71ef653508e1fa27f402925b77229
SHA512d27253dfff897bb7bed214c1a6749ea49c58fb847bfde84deb129babdf3f72ac187b191719ffbcd5aa93d2eb8eefbf697bd29667265af7edd67090142548e968
-
Filesize
405KB
MD5d210d7aaeec5222740bce8da9a1ba195
SHA168219d51fbbaf26bf6ba5aa4598e4cf08f5ac702
SHA2567281b274d848f116141307f1b15c3c29eff71ef653508e1fa27f402925b77229
SHA512d27253dfff897bb7bed214c1a6749ea49c58fb847bfde84deb129babdf3f72ac187b191719ffbcd5aa93d2eb8eefbf697bd29667265af7edd67090142548e968