Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 08:19
Behavioral task
behavioral1
Sample
219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe
Resource
win7-20230831-en
windows7-x64
17 signatures
150 seconds
General
-
Target
219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe
-
Size
274KB
-
MD5
5f78b5cb52e44a34c8403dc025eb9c86
-
SHA1
06d1ed39ebf8ecab97b1e0d493508423dc6c1819
-
SHA256
219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573
-
SHA512
37fc19419918f6cedb14267a395babbff6ed649741b31c7bbdc50a4598302d2ebf2d7ab591393babeefb63e816f6b798b9d228d77a3ab01ddb086d8e77160578
-
SSDEEP
6144:abTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:aPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\System32\drivers\aZdfW7.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\dwJoSUAJXDnYR.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\Ih1HcY2gF1uM.vss Explorer.EXE File opened for modification C:\Windows\system32\drivers\BR8Fn3wPAR9a.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\YJLT6ieXzuT.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\dFweJqWC92VI.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\RBuU7zUN9z7.eor Explorer.EXE File opened for modification C:\Windows\system32\drivers\qaRMlwrBf5BB.nhc Explorer.EXE File opened for modification C:\Windows\system32\drivers\4GUGxxrm4jNo.hlw Explorer.EXE -
Deletes itself 1 IoCs
pid Process 1688 cmd.exe -
resource yara_rule behavioral1/memory/2552-0-0x0000000000B30000-0x0000000000BBC000-memory.dmp upx behavioral1/memory/2552-3-0x0000000000B30000-0x0000000000BBC000-memory.dmp upx behavioral1/memory/2552-63-0x0000000000B30000-0x0000000000BBC000-memory.dmp upx behavioral1/memory/2552-268-0x0000000000B30000-0x0000000000BBC000-memory.dmp upx behavioral1/memory/2552-635-0x0000000000B30000-0x0000000000BBC000-memory.dmp upx -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 114.114.114.114 -
resource yara_rule behavioral1/files/0x000a000000016d01-678.dat vmprotect behavioral1/files/0x0018000000016d01-706.dat vmprotect behavioral1/files/0x0026000000016d01-734.dat vmprotect behavioral1/files/0x0034000000016d01-762.dat vmprotect -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\gHcUyE2OVmya.bto Explorer.EXE File opened for modification C:\Windows\system32\7omqmggWog5.zpi Explorer.EXE File opened for modification C:\Windows\system32\ppUSVvNiJ8MEp.ord Explorer.EXE File created C:\Windows\system32\ \Windows\System32\Ss8e3hS.sys Explorer.EXE File opened for modification C:\Windows\system32\iCm2BqML0wV2.sys Explorer.EXE File opened for modification C:\Windows\system32\jKdWKvD9no.kqm Explorer.EXE File opened for modification C:\Windows\system32\sWvYiC6s5c0B.sys Explorer.EXE File opened for modification C:\Windows\system32\YXUzMj3wi3dx.sys Explorer.EXE File opened for modification C:\Windows\system32\GuytY1XeDGdTXw.sys Explorer.EXE -
Drops file in Program Files directory 26 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\9H6cBZoCwgynj.sys Explorer.EXE File opened for modification C:\Program Files\Zjw2hKa0g82cb.tkv Explorer.EXE File opened for modification C:\Program Files\Common Files\5cd0f846.js Explorer.EXE File opened for modification C:\Program Files\Common Files\lib\6c4921a7.js Explorer.EXE File opened for modification C:\Program Files\Google\3de0a7f4.js Dwm.exe File opened for modification C:\Program Files\xbPO8vO85Bo.gvf Explorer.EXE File opened for modification C:\Program Files (x86)\0kdD1okOe6.oan Explorer.EXE File opened for modification C:\Program Files\p0w38gHP2qWxf.cak Explorer.EXE File opened for modification C:\Program Files (x86)\DAt6TA6ywgC.bkn Explorer.EXE File opened for modification C:\Program Files (x86)\qWBpZPQ2IiLEz4.xmc Explorer.EXE File opened for modification C:\Program Files\Common Files\manifest.json Explorer.EXE File opened for modification C:\Program Files\Common Files\4d58cee5.html Explorer.EXE File opened for modification C:\Program Files\Google\manifest.json Dwm.exe File opened for modification C:\Program Files\KGFkPV5WB5.sys Explorer.EXE File opened for modification C:\Program Files\Google\lib\6c4925eb.js Dwm.exe File opened for modification C:\Program Files (x86)\SEfQfk974dc.sys Explorer.EXE File opened for modification C:\Program Files\B9wmCTKPKK.sys Explorer.EXE File opened for modification C:\Program Files (x86)\vcKzyJfbhb.bxk Explorer.EXE File opened for modification C:\Program Files\Google\4d58d1f1.html Dwm.exe File opened for modification C:\Program Files (x86)\Er08YkCMoW9kv.sys Explorer.EXE File opened for modification C:\Program Files\ar9B4xfIfhM30K.sys Explorer.EXE File opened for modification C:\Program Files\XRonVv39vVUWG.sys Explorer.EXE File opened for modification C:\Program Files (x86)\pBsuuh6retM.sys Explorer.EXE File opened for modification C:\Program Files\Common Files\3de0a584.js Explorer.EXE File opened for modification C:\Program Files\Google\5cd0fbee.js Dwm.exe File opened for modification C:\Program Files\2nmvM1f3gcb9Z.qsg Explorer.EXE -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\L6nrdaOAGRU.nod Explorer.EXE File opened for modification C:\Windows\bVWfNyI28yF.bpo Explorer.EXE File opened for modification C:\Windows\2jzRf8bs9na7Qf.sys Explorer.EXE File opened for modification C:\Windows\8IghRX5tvF2ic2.dpi Explorer.EXE File opened for modification C:\Windows\0ca7eqYKekD.jyk Explorer.EXE File opened for modification C:\Windows\FZzzPkPuJtg.sys Explorer.EXE File created C:\Windows\7ON8XZ.sys Explorer.EXE File opened for modification C:\Windows\FHyDye1LAp.sys Explorer.EXE File opened for modification C:\Windows\UdULMr2rvs6Lg.sys Explorer.EXE File opened for modification C:\Windows\err_2552.log 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2192 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1188 Explorer.EXE -
Suspicious behavior: LoadsDriver 59 IoCs
pid Process 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Token: SeTcbPrivilege 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Token: SeDebugPrivilege 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Token: SeDebugPrivilege 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Token: SeDebugPrivilege 1188 Explorer.EXE Token: SeDebugPrivilege 1188 Explorer.EXE Token: SeDebugPrivilege 1188 Explorer.EXE Token: SeIncBasePriorityPrivilege 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe Token: SeDebugPrivilege 1188 Explorer.EXE Token: SeBackupPrivilege 1188 Explorer.EXE Token: SeDebugPrivilege 1188 Explorer.EXE Token: SeDebugPrivilege 1164 Dwm.exe Token: SeBackupPrivilege 1164 Dwm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1188 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 20 PID 2552 wrote to memory of 1188 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 20 PID 2552 wrote to memory of 1188 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 20 PID 2552 wrote to memory of 1188 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 20 PID 2552 wrote to memory of 1188 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 20 PID 2552 wrote to memory of 420 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 3 PID 2552 wrote to memory of 420 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 3 PID 2552 wrote to memory of 420 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 3 PID 2552 wrote to memory of 420 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 3 PID 2552 wrote to memory of 420 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 3 PID 2552 wrote to memory of 1688 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 32 PID 2552 wrote to memory of 1688 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 32 PID 2552 wrote to memory of 1688 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 32 PID 2552 wrote to memory of 1688 2552 219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe 32 PID 1688 wrote to memory of 2192 1688 cmd.exe 34 PID 1688 wrote to memory of 2192 1688 cmd.exe 34 PID 1688 wrote to memory of 2192 1688 cmd.exe 34 PID 1688 wrote to memory of 2192 1688 cmd.exe 34 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14 PID 1188 wrote to memory of 1164 1188 Explorer.EXE 14
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"2⤵
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\219b8ecb49ab73378fc40ed08171a05765db0194ffc300e198dcbe698773f573.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:2192
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A
Filesize2KB
MD52818084a9e9c1a6ea4afcabc2addedaa
SHA113c59025d416f769fffeb9e239b2e16c8b5f7868
SHA2566f4fa276959221d8e18c0531d8d6e374bc3630f0d2a9cb3bc53d9332b31fe4f0
SHA5122c0222371add59a2f3dc64fc5fc8e4a72076c279c2f8697fe84afc948b2d9f8033b5e47a67f2167fc65b6749c2c558b672fad16b683f5d4769678a434821577b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD591a2dd953cb6f8edfa3c5a3b7c680f68
SHA145fabdf01269f6ff34cee0a3304d97e8dbb74486
SHA2569806b25d68e91516099c89be4870be1aadc6be2de5611dc24e426026ebf5ffbd
SHA512f1555dc73fe7e5a137385fbb158c587651345f2cb8c28ff11590fe65accdb8cf753b775e804f3f33d30e4c3cd94331356715f63b7856ad567ac98bec639f0bda
-
Filesize
599B
MD5a87c1c0bd5b4f68755a9cc6b52c6c2be
SHA123d9859148cd758aa9eac8e5e5b3fa7b16968b28
SHA25644b9e82998f53b67924b619840930d3c0e22877283dd612da9b55a36ea034666
SHA51293c5fb66c5a95440be30a29ec04a09e3a174af66e584bd8fbcb2aabe74d643fba82f5ec6915b5d1fa3ba4d3eae7c60f8d5dc46438e420b4a46924c203e601cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A
Filesize484B
MD53a5838208f8452d0874273d03db7feaf
SHA1b9432df018167239d51be96b2bb92097f6916c9e
SHA256b72b97fa1ce1c7d26757f0ed3a2cee806f05710940fb4c10e9592345d1096b1a
SHA512b9615870e054e1dabfb3308a10154e29b7a6520f8ec59663f0ca006938cb6936cce9f3e31effe9f217413837759bc0e70aaeb4d4cd58a6acfe3b17b9aeb9f4bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537de3f8202353fb4d7a5462b03ffc3a3
SHA162238ec2b0018935a4d949d8a164827bf259c127
SHA2561c0148f073a0d76a439c5ea926fc8d67be84df40dd967fde92800142d1dc10f9
SHA512eff9626e25c9454fffba1d4f5d3d7af5139f480841d3bb5137c4340863d1edb644a71cf1c28fb18616e61a1539ba01090a9cd374c99f4a3e354f4070767f2e60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD583157ae45efc6228c31b8916f3ff855d
SHA1d0b0a02471e94fad4df7ea48859e2e8ef3b6430c
SHA256515ebb6ee84fe8900cf8130e1c73fc16ae189510ed740aac83833a1bcfa15788
SHA512cc6f613f16024463a5b2c913ec0c6b1a58bbf328f3162be2afb89d64726dd00ee854b74a824452d43373211aa54c220b30e27f48ac6bcac6c70d2617728b6556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4
Filesize504B
MD5c4996d3cec181b4ea4924bb27e97f9c9
SHA14cced27444b920cbf485b076e05a054d6c0ed543
SHA256510caa57e41a3bba11c854abe4d2ee0455b7da878d1c43ee98c62db80f62fe22
SHA512693ce96cae2d52594f9ca941fc1550635b497afc21f8aacd009f4dd1bce817cfe3ade09156542b403fe74ecd83d2fc9f781516f51b5aa7d18b339ded09e3f673
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
447KB
MD5c677eb2481f5e2879179713738e69ba5
SHA1821ae1f88b6a4ced5bed868f98d531ec45058a0b
SHA256c7d0b1ae03df1edb2fb5495fba97cb2e459aac26e02e6ab95aed6bb29fe2c75d
SHA512991d321ba2be14a347f1b70e946c330278e186581b520a5b5b34bbe18bd72f8b2554d50e31d9ad2593b54f7216d3df84c843f4e377c4439d48c274939aac2c8f
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
415KB
MD5beb2e0ae66726d7e2c8e51345748eee6
SHA121ba73fc1366a157e54c54f501e81cd19b8d8a10
SHA25623db8c2423bcbf7b65e727dacebff408b5b4ac7c575b2ec99754c86e959e6763
SHA512c94811ec460a6013c28b6b22d5dc85eac86f409eb7b21d2bbd265ff3a4e23d8628cdb4a813d9502407324fc9a3e0d02c824a161e175e61a7f5da935e450aff9a