Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
306s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 17:40
Static task
static1
Behavioral task
behavioral1
Sample
hyreszxc.msi
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
hyreszxc.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
hyreszxc.msi
-
Size
8.6MB
-
MD5
a0e0687c1f4e8f50243db910ebf2e623
-
SHA1
72629d1d68dbfb601cc8390d642ad7a1289fb946
-
SHA256
7a92489050089498d6ec05fb7bdfad37da13bb965023d126c41789c5756e4e02
-
SHA512
31f631b7ec686cab39b0d5edf7e2b62b43f22cb74479c56fefb6d226ba1b89162a41d7dcaa2f9d81c4633f46c782d3229805bf6a9b2336404066bd120e3cf721
-
SSDEEP
196608:5kdAirk9zqV8GinTPMoGkd/ROfL0uUmN4in1VAnEVYxVSe3yt/:edAirAzqVAnTPMgd+0ogHnF3y
Malware Config
Extracted
darkgate
user_871236672
http://hadfadf87yuadfad.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
CbTWFsAhFuOWYT
-
internal_mutex
txtMut
-
minimum_disk
40
-
minimum_ram
7000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
user_871236672
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2300 windbg.exe 2996 Autoit3.exe 2712 Autoit3.exe -
Loads dropped DLL 7 IoCs
pid Process 2368 MsiExec.exe 2368 MsiExec.exe 2368 MsiExec.exe 2368 MsiExec.exe 2368 MsiExec.exe 2300 windbg.exe 2300 windbg.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 772 ICACLS.EXE 1804 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76c88d.msi msiexec.exe File created C:\Windows\Installer\f76c88e.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f76c88d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICB4B.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\f76c88e.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2712 Autoit3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2444 msiexec.exe 2444 msiexec.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2864 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeSecurityPrivilege 2444 msiexec.exe Token: SeCreateTokenPrivilege 1116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1116 msiexec.exe Token: SeLockMemoryPrivilege 1116 msiexec.exe Token: SeIncreaseQuotaPrivilege 1116 msiexec.exe Token: SeMachineAccountPrivilege 1116 msiexec.exe Token: SeTcbPrivilege 1116 msiexec.exe Token: SeSecurityPrivilege 1116 msiexec.exe Token: SeTakeOwnershipPrivilege 1116 msiexec.exe Token: SeLoadDriverPrivilege 1116 msiexec.exe Token: SeSystemProfilePrivilege 1116 msiexec.exe Token: SeSystemtimePrivilege 1116 msiexec.exe Token: SeProfSingleProcessPrivilege 1116 msiexec.exe Token: SeIncBasePriorityPrivilege 1116 msiexec.exe Token: SeCreatePagefilePrivilege 1116 msiexec.exe Token: SeCreatePermanentPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 1116 msiexec.exe Token: SeRestorePrivilege 1116 msiexec.exe Token: SeShutdownPrivilege 1116 msiexec.exe Token: SeDebugPrivilege 1116 msiexec.exe Token: SeAuditPrivilege 1116 msiexec.exe Token: SeSystemEnvironmentPrivilege 1116 msiexec.exe Token: SeChangeNotifyPrivilege 1116 msiexec.exe Token: SeRemoteShutdownPrivilege 1116 msiexec.exe Token: SeUndockPrivilege 1116 msiexec.exe Token: SeSyncAgentPrivilege 1116 msiexec.exe Token: SeEnableDelegationPrivilege 1116 msiexec.exe Token: SeManageVolumePrivilege 1116 msiexec.exe Token: SeImpersonatePrivilege 1116 msiexec.exe Token: SeCreateGlobalPrivilege 1116 msiexec.exe Token: SeBackupPrivilege 2796 vssvc.exe Token: SeRestorePrivilege 2796 vssvc.exe Token: SeAuditPrivilege 2796 vssvc.exe Token: SeBackupPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeDebugPrivilege 2864 taskmgr.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 3048 DrvInst.exe Token: SeLoadDriverPrivilege 3048 DrvInst.exe Token: SeLoadDriverPrivilege 3048 DrvInst.exe Token: SeLoadDriverPrivilege 3048 DrvInst.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: 33 832 mmc.exe Token: SeIncBasePriorityPrivilege 832 mmc.exe Token: 33 832 mmc.exe Token: SeIncBasePriorityPrivilege 832 mmc.exe Token: 33 832 mmc.exe Token: SeIncBasePriorityPrivilege 832 mmc.exe Token: 33 832 mmc.exe Token: SeIncBasePriorityPrivilege 832 mmc.exe Token: 33 832 mmc.exe Token: SeIncBasePriorityPrivilege 832 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1116 msiexec.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 1116 msiexec.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 mmc.exe 832 mmc.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2444 wrote to memory of 2368 2444 msiexec.exe 33 PID 2368 wrote to memory of 772 2368 MsiExec.exe 34 PID 2368 wrote to memory of 772 2368 MsiExec.exe 34 PID 2368 wrote to memory of 772 2368 MsiExec.exe 34 PID 2368 wrote to memory of 772 2368 MsiExec.exe 34 PID 2368 wrote to memory of 1648 2368 MsiExec.exe 36 PID 2368 wrote to memory of 1648 2368 MsiExec.exe 36 PID 2368 wrote to memory of 1648 2368 MsiExec.exe 36 PID 2368 wrote to memory of 1648 2368 MsiExec.exe 36 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2368 wrote to memory of 2300 2368 MsiExec.exe 40 PID 2300 wrote to memory of 2996 2300 windbg.exe 41 PID 2300 wrote to memory of 2996 2300 windbg.exe 41 PID 2300 wrote to memory of 2996 2300 windbg.exe 41 PID 2300 wrote to memory of 2996 2300 windbg.exe 41 PID 2368 wrote to memory of 1124 2368 MsiExec.exe 42 PID 2368 wrote to memory of 1124 2368 MsiExec.exe 42 PID 2368 wrote to memory of 1124 2368 MsiExec.exe 42 PID 2368 wrote to memory of 1124 2368 MsiExec.exe 42 PID 2368 wrote to memory of 1804 2368 MsiExec.exe 44 PID 2368 wrote to memory of 1804 2368 MsiExec.exe 44 PID 2368 wrote to memory of 1804 2368 MsiExec.exe 44 PID 2368 wrote to memory of 1804 2368 MsiExec.exe 44 PID 2488 wrote to memory of 2712 2488 cmd.exe 50 PID 2488 wrote to memory of 2712 2488 cmd.exe 50 PID 2488 wrote to memory of 2712 2488 cmd.exe 50 PID 2488 wrote to memory of 2712 2488 cmd.exe 50 PID 832 wrote to memory of 2652 832 mmc.exe 52 PID 832 wrote to memory of 2652 832 mmc.exe 52 PID 832 wrote to memory of 2652 832 mmc.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\hyreszxc.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1116
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91FC0E4376A524DB85DE6E4DDC2720F52⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5630e676-90c5-4260-8108-af277fcb6fc9\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:772
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\MW-5630e676-90c5-4260-8108-af277fcb6fc9\files\windbg.exe"C:\Users\Admin\AppData\Local\Temp\MW-5630e676-90c5-4260-8108-af277fcb6fc9\files\windbg.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tmpa\Autoit3.exec:\tmpa\Autoit3.exe c:\tmpa\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-5630e676-90c5-4260-8108-af277fcb6fc9\files"3⤵PID:1124
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-5630e676-90c5-4260-8108-af277fcb6fc9\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:1804
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2864
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000570" "000000000000031C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:344
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\tmpa\Autoit3.exeAutoit3.exe script.au32⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2712
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 10522⤵PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
MD56ecd06249526d985bd28cc1864e8c143
SHA15ab8062d24dfda2ec3c5ebca958485041f92a562
SHA2568931c76f39a6e4052c95422cd9ba00cd6648cb12618ed5007a2aef769592b3dd
SHA512eb5dca026bf2c011be9b752432d1096ffa145efadf2bd1726a6076b2ca0f6d34f00647a321401df1d70733c1b6a05633b6966e542d45ff1dac7c7c898ebe3ca5
-
Filesize
1.2MB
MD5c5f6eb13db175fbcd0925434424df781
SHA12197137928fff79f8b11e966ffb6a9eb5112a3c8
SHA2566571ea1fa9e8427418ab40ab1ea6e1555b7c59a2579b2f34dded39d81e8def50
SHA51240eca3c9a3c2ca653c5c78d1205250b2077265ad5cfb9609a6b34649699b62236c61d5cdb415767749ff86e91afe6830d98e6f5eb3390b2c57d28b4a45a220a4
-
Filesize
1.3MB
MD5a384c8b03d6d72e9f9e268d265e8b435
SHA13b238b66b33e2dc191da037973a79f01d50ee2d4
SHA2569310b4483d9e20dfdc28e8603a026f0c52b07089a290955629970b96a51b977b
SHA51294ada636935ecf52ce4625b23216b0dde06e58fd09f34a4727531bf5299d45b5e705b8c043713f14cc8c007ba82645a0dc54402badea418bf3677967c960c565
-
Filesize
1.1MB
MD592028b5b43ea981f2172f2e9ce6556bf
SHA16da86abe3bc0caf500908ec7b8e841b797948fec
SHA2567d5d5115c1f29592dba340a167e7144a539df8201578913fbbbb428b26d8c7ed
SHA5121af0cb17ff6b09c49c0ea7433d665b123ea7e7c6a46c06088bfaeaee3a3ce01aab27105a36f906a17dc0c29c830ef54fb4b005b47cdecd3612ce9f0d3059c62f
-
Filesize
1.2MB
MD53f3788816f75078edb9817a98259a223
SHA11eb191dd0dcff72f5922aa775dc95dced7967bd5
SHA256a2f02cb0c6dbba41b8a4572c4546fbb7216efe8dc18ccef16e1a14d7f8ccddd0
SHA5122c17408796ba518ad117983526f5c0380a36b6f18974132a69923e95288c3ced9ca05e615ea5d567bde100c4cd8469bf172daba96f4e5032520ccb75560d5b62
-
Filesize
1.1MB
MD52ccc17c1a5bb5e656e7f3bb09ff0beff
SHA105866cf7dd5fa99ea852b01c2791b30e7741ea19
SHA256411b6ce9e97a4d828ab43dcf896f8ea09b5e9dc02874909f53ca1e0f10caeed2
SHA51246b7362a2df870018707d89a7340ac0c07a2a357c504dbd944699c0231b4f984661b9f112b9d4869e55cf208ed5968f3ec5b5b35a956329679fb6e48ada7c4c5
-
Filesize
903KB
MD566732fccbeee97415b033c017e594196
SHA16db8fada912e6ea219b526cbe1a136a6afdabffb
SHA256dbefd6274b1ffc0d387d76972a9d93ea862d3be451aa3d0b8e0335708136addc
SHA51270b11b616b108e284d8f47e9881db5c15e2a5d8ee41d6d0e26b43de19203811da6402e8f47d1845bc30e9ba8cbe71195c8594723c5ac966521dda2dc39f4a248
-
Filesize
92KB
MD58b305b67e45165844d2f8547a085d782
SHA192b8ed7652e61fdf3acb4ce74f48bcc9ed14b722
SHA256776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b
SHA5122bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6
-
Filesize
1.8MB
MD5d12826317bcc07a47d9e0b83fd487c5e
SHA1f129cfa73c8ae56e72c11f93e05823916bdc86f0
SHA256b37677c2a7cdc0cc97d9f942fc0423037eb50b8f1685ceee45cf97b9477eaadd
SHA51245297229d26909945a2422ab879611410f5c31d5f2eeb4c926a2d555c9a6771f02295ee9a65efdb893c8a44d88af0fc0224373f5ce0e6a408c42f02b25f76a36
-
Filesize
1.3MB
MD5f540f998d60d6fc1c23f942ed5857296
SHA11ef333bfea08b37cda99ea1353d52928a4458f28
SHA256d37e54faccf247c73e59fec33001000567e44a4e0adf6f637c3aea32e76d8b11
SHA512e3369f9848dcb0661c5d932f0702dffa304541b6a7a0a8c9753247cde1083277cd4ac3600927476dafc7be73fe0bae2ace0c7e7320ae8ac9fea0660edb777b9c
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
1KB
MD5d6cbc32cbd2599eb4473d216bb1194d7
SHA1e9e315f38d03e5b96105a3de870a88a6aae74104
SHA2567e7a7f4c21fcb87581ad665b9addfa8a29523c55cdd27385147e5bd8aebf7e90
SHA5129dab7f90c8fb2db468210e8337402017e45945317a2786875d7e3a54300bcac0ef8734672d9b9d0c292390b8f2a4d1813d2fcd4a8755a0495f05146e7de89a36
-
Filesize
1KB
MD5d6cbc32cbd2599eb4473d216bb1194d7
SHA1e9e315f38d03e5b96105a3de870a88a6aae74104
SHA2567e7a7f4c21fcb87581ad665b9addfa8a29523c55cdd27385147e5bd8aebf7e90
SHA5129dab7f90c8fb2db468210e8337402017e45945317a2786875d7e3a54300bcac0ef8734672d9b9d0c292390b8f2a4d1813d2fcd4a8755a0495f05146e7de89a36
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
489KB
MD5fbe2606010b7d86a18af938b3dcb08c6
SHA1c67db324c8159dc141eab06379db31d276375dc4
SHA2563371278138866e0b7fd051b836dba80b06565944c4161ff0c11d5eda6c6c210f
SHA512368c390c353ed1c1206607e5bc92dd71dddb6ab656c81e377f80962ec94af7d24d23996d921e38a850979b4b25021677fa897d97feb14665cf0fdf6ca484c22b
-
Filesize
1.3MB
MD5f540f998d60d6fc1c23f942ed5857296
SHA11ef333bfea08b37cda99ea1353d52928a4458f28
SHA256d37e54faccf247c73e59fec33001000567e44a4e0adf6f637c3aea32e76d8b11
SHA512e3369f9848dcb0661c5d932f0702dffa304541b6a7a0a8c9753247cde1083277cd4ac3600927476dafc7be73fe0bae2ace0c7e7320ae8ac9fea0660edb777b9c
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
