Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    169s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 14:34

General

  • Target

    013d2649e3f6fccff011536a2c840755.exe

  • Size

    184KB

  • MD5

    013d2649e3f6fccff011536a2c840755

  • SHA1

    fd9a03025041ecacaa7b769126aecac08c84b189

  • SHA256

    e0fe1ef5fa4f34952183b3a24252cc42b742e48e961d6a15eab2f03d0bc2f69c

  • SHA512

    9927cdf6f5d9152a726712bce9c3586e0f4f09c5455c95050ec242ef26d31e24f2f2a123abf7a3ef4f58aba00eab630a049831f7aaa050f1bba1d66160f082c4

  • SSDEEP

    3072:aGFlomhTSwHYfOCWMhx/A8wM3x6MuvzlvGUxS+/HMtlPvpFg:aGfoPeYfwMX/A8yRQvtlPvpF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Program crash 24 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\013d2649e3f6fccff011536a2c840755.exe
    "C:\Users\Admin\AppData\Local\Temp\013d2649e3f6fccff011536a2c840755.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-29337.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1272
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-61.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:432
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-49122.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2440
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-22584.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:2628
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1796
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2512
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-23939.exe
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1140
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-9722.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:924
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-11917.exe
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1588
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2108
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2532
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
                                    17⤵
                                      PID:1104
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1232
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
                                      17⤵
                                        PID:2616
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-47408.exe
                                    15⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2492
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-8098.exe
                                      16⤵
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2284
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
                                        17⤵
                                          PID:1764
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
                                  13⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1476
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
                                    14⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1692
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
                                      15⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2388
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 188
                                        16⤵
                                        • Program crash
                                        PID:1360
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-53623.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1312
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:832
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:1436
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
                        8⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:1628
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
                          9⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:2556
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
                            10⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2436
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-3331.exe
                              11⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1620
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
                                12⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1232
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
                                  13⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1912
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
                                    14⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1916
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 240
                                      15⤵
                                      • Program crash
                                      PID:1568
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-63505.exe
                                    14⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1088
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
                                      15⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:600
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
                                        16⤵
                                          PID:2548
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
                                    13⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2688
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
                                      14⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1272
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-57024.exe
                                        15⤵
                                          PID:1096
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
                                        14⤵
                                          PID:2128
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
                                      12⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:872
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2592
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-63573.exe
                                          14⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1784
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
                                            15⤵
                                              PID:2136
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
                                            14⤵
                                              PID:1796
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:2152
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2164
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2748
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1100
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 240
                            5⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:2008
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-24842.exe
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1896
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:2652
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-16450.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-16450.exe
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:2276
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetWindowsHookEx
                                PID:2324
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
                                  8⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2052
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-30415.exe
                                    9⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1068
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-53300.exe
                                      10⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2160
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-57963.exe
                                        11⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2176
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-11149.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-11149.exe
                                          12⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2484
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-44528.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-44528.exe
                                            13⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2152
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-51622.exe
                                              14⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1992
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1908
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
                                                  16⤵
                                                    PID:2352
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 380
                                                    16⤵
                                                    • Program crash
                                                    PID:2760
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-55270.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-55270.exe
                                                  15⤵
                                                    PID:2408
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
                                                      16⤵
                                                        PID:2060
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 380
                                                      15⤵
                                                      • Program crash
                                                      PID:1468
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
                                                    14⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2924
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
                                                      15⤵
                                                        PID:312
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 372
                                                        15⤵
                                                        • Program crash
                                                        PID:2768
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-31372.exe
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3020
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
                                                      14⤵
                                                        PID:1940
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 384
                                                        14⤵
                                                        • Program crash
                                                        PID:2440
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 376
                                                      13⤵
                                                      • Program crash
                                                      PID:1708
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
                                                    12⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1580
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
                                                      13⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2628
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
                                                        14⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2412
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
                                                          15⤵
                                                          • Executes dropped EXE
                                                          PID:1052
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 372
                                                          15⤵
                                                          • Program crash
                                                          PID:2752
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
                                                        14⤵
                                                          PID:1116
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 384
                                                          14⤵
                                                          • Program crash
                                                          PID:628
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
                                                        13⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1676
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
                                                          14⤵
                                                            PID:2640
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 380
                                                            14⤵
                                                            • Program crash
                                                            PID:2056
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 380
                                                          13⤵
                                                          • Program crash
                                                          PID:2892
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 380
                                                        12⤵
                                                        • Program crash
                                                        PID:2972
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19872.exe
                                                      11⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2536
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
                                                        12⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2724
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
                                                          13⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:304
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-56147.exe
                                                            14⤵
                                                            • Executes dropped EXE
                                                            PID:2620
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 380
                                                            14⤵
                                                            • Program crash
                                                            PID:1316
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
                                                          13⤵
                                                            PID:2404
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 376
                                                            13⤵
                                                            • Program crash
                                                            PID:1648
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 376
                                                          12⤵
                                                          • Program crash
                                                          PID:2436
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 376
                                                        11⤵
                                                        • Program crash
                                                        PID:2720
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 368
                                                      10⤵
                                                      • Program crash
                                                      PID:572
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 368
                                                    9⤵
                                                    • Loads dropped DLL
                                                    • Program crash
                                                    PID:2468
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 376
                                                  8⤵
                                                  • Loads dropped DLL
                                                  • Program crash
                                                  PID:2872
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 368
                                                7⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:2948
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 368
                                              6⤵
                                              • Loads dropped DLL
                                              • Program crash
                                              PID:2364
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 368
                                            5⤵
                                            • Loads dropped DLL
                                            • Program crash
                                            PID:776
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 376
                                          4⤵
                                          • Loads dropped DLL
                                          • Program crash
                                          PID:2416

                                  Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-16120.exe

                                    Filesize

                                    184KB

                                    MD5

                                    80132f519e6bf116d4163297ced28eec

                                    SHA1

                                    121c8b0c96d8ddbb59ea32cd560fd34febf5355f

                                    SHA256

                                    941faeebc789a5d78da48c7ffa3686c41df1a5ef478d3f637b278bb19eb1eeb7

                                    SHA512

                                    28e9f1b15234c736c7b84c26d3c1ca696fe9bf44082f07c3dc1706b3908f258440afd3923487121c0390674a78d057db037913339fbc90a2d8eecd07565f11d3

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-16450.exe

                                    Filesize

                                    184KB

                                    MD5

                                    ee7ac5793911e300f04ee990a6fa3428

                                    SHA1

                                    80d2a851d035d2a7d88736fa7b93c76fb093924b

                                    SHA256

                                    9a17a78da109d36aa5aa70775b4ac357fa7cd189d8a6b9f4db940094280cd757

                                    SHA512

                                    42bc7dc27cb267a6db508bf787e2e66f7f9389767fc6b5977b784ad3fdb41804064723563dc11540535075360d86db8e955ddbd1202d8c6fcd965c989503456b

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe

                                    Filesize

                                    184KB

                                    MD5

                                    00eb681fdcbadffd87f4bfa7223b1cad

                                    SHA1

                                    2b886626e0af9b1784d3feb5d5098829c007ddff

                                    SHA256

                                    63a62cb7b66339c93c50328c6b715d356145bb7a5c26ac0d2944d1670a4a4f1d

                                    SHA512

                                    2fa4407402f55af96bb5143200d3b90ff18705013e3eb8706037133656a08c998144598ec93c0b96611389622ce0e91ce474b209e39d38109224ab673c85d5ee

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe

                                    Filesize

                                    184KB

                                    MD5

                                    52ac7eb228048a90078d8c78674dd1c8

                                    SHA1

                                    fa4ed7fc1b1ca322967e945c8d0e103e020dc36c

                                    SHA256

                                    be746a6670e92b8b7e0fc1265d86e12fa9a8347eebe80cf6addfab4237bb8261

                                    SHA512

                                    e55ef83ad500f1ddcaa803cf8f303b8047a3ccfcc11aa2b18745ac8975f70cee97d83c2ae6f5d750dfbabe5cd67b1e2cf259dbce9674784d1972ad159e545279

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe

                                    Filesize

                                    184KB

                                    MD5

                                    d5ec28fbae43e21306b6efb7acf0e3e5

                                    SHA1

                                    c2668b070b4f9c3515d57d790afd56975f9dd274

                                    SHA256

                                    9b8922c23de8a0d06203d36cef5b83bf8302b1eb54f54097386090657bd9fc89

                                    SHA512

                                    f61f292313489843e8dc7b6ec812c3971009b1851b700893fd41b7aef665fb0a048ed796c85ceeee7f5b377e33c3852816b98256df62548cac0b9f5423ed2c8b

                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe

                                    Filesize

                                    64KB

                                    MD5

                                    fdc5c4b384862a00955e5605cafc1d61

                                    SHA1

                                    1ea8fda5adfadf6f833335dd997094ec8c04d9ca

                                    SHA256

                                    7edb1cef84da55996c2db649b31cfb871083e824fed63da4dce7c1c89d792fab

                                    SHA512

                                    31e277d2bc83d8be084634f607344942f2b1d36e31d51828d2eeed8c1bd4bced06861b9b64f90bc9781ce91bb8ba41cfd8b6f8fe135aace1752100b034ede466

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-13887.exe

                                    Filesize

                                    184KB

                                    MD5

                                    49135315b16a9d37b4146f51b6f3e324

                                    SHA1

                                    6c2502a07395605273bacfe083092e16aba75bd6

                                    SHA256

                                    a4a9fe04c3682d758d176e7befb466540d203697217ac22e7145becf5302438d

                                    SHA512

                                    0270bef1eb13fb27a704fcfd646bd0933ef32d5ade947e0c3b05b4931839a5d3068a44259308333453b732e80f20a56228eb03af3680fafc9a687bf8463e9a40

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-24618.exe

                                    Filesize

                                    184KB

                                    MD5

                                    8e7a030845c3c51fe990bf8d3c24660a

                                    SHA1

                                    347a0fd5fda02ba381414c25a915ed337a4d312b

                                    SHA256

                                    3def426e148635006d406987b6fc2b74c8af1ac760f0aa219ebe0c3575636d71

                                    SHA512

                                    2efc0f48b97995fdf4bdbb76d4c9e9dcdb78c2ef1e08f68e9f63706511eb6f852b3697807f9e6aca082fd88c80e7e01b6419d12fc8fea93655ca38e0b58b0f4f

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-24842.exe

                                    Filesize

                                    184KB

                                    MD5

                                    4682d35c4f3e125dc8eb5919e776c8fb

                                    SHA1

                                    49d0384c70fd3fb5f941f272cd17c3fa2c1057be

                                    SHA256

                                    5ef2566176af6e9710ab068455f6a7064a5772c6dd817ee633ad934071d1bcc3

                                    SHA512

                                    ecb3d1c881f5b65cce88302aef5404d48c17d9de0c95faaef9a88a481d9d4e0c024fa2ee7135fa620780cca206134a076d334a799d60db4a55d8bab8884644f7

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-29337.exe

                                    Filesize

                                    184KB

                                    MD5

                                    c6bf26e84a95b2f568d1d16b06e0118f

                                    SHA1

                                    2f9cfb8d3331ca4874305df5d3f8e7a46d23c5e6

                                    SHA256

                                    825a7274aaf61c6b18afbc830964b72ea44d687a7e11a9c869264fbee5970d38

                                    SHA512

                                    fef699da81815d4e05c7bf7cfc4e6b0ddb01a5b716f5090197cbcb5ab7c3050b67656f70de4e75f7e6b6d6d4c66c17c8db7955dba4cb8d2fe686a6e2afffb2c8

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-35044.exe

                                    Filesize

                                    184KB

                                    MD5

                                    1116c4a816140bbc1ea0e4ff931299be

                                    SHA1

                                    cbaf9a0742d418020014f9f2add06fa92061621d

                                    SHA256

                                    e9ff1aa5254e4069beeb81afd32e0b95497d53ccc2b8a419d7ba8a8d74720df0

                                    SHA512

                                    2eae1f112f0beae3c349d573807cc0735eb279f07027abb01e3c9d781095eb48b6402b991cc0c2eedc8f5d242f97594c4f500f7d4eec0e41d0fc6855e169fef7

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-37671.exe

                                    Filesize

                                    184KB

                                    MD5

                                    7161103bd9c11270806ee6e4ce8d0200

                                    SHA1

                                    0113d1487c6100376edfe91c99de357b386561d5

                                    SHA256

                                    b0532dfcf7eece0114d3aa29e0ec667f6438fa8fd2cd127b77455ef34aada0f9

                                    SHA512

                                    46eb2dba5f3eff4bda25943e17f4dd4e0c7a916b9f835c6a8e5957f619f66dc80b2feaa617fc23d982feb6452bccface5fd386ac0230adf01f061f632d7efe8a

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-48600.exe

                                    Filesize

                                    184KB

                                    MD5

                                    50a07a9477f1e18e50983f5a7a09da62

                                    SHA1

                                    a32cc681d031d4ddbe00065a17bad17db532d849

                                    SHA256

                                    de6190df86b6d1064c2216d3d3d7da034a79ea2dda839bd2a3824fdac5625a89

                                    SHA512

                                    02c7f1d05eec637be6aa8ee0a824be0427ead58a81bcf77f06fac8e5697a58447d9be8c1a26e97dad1d7a202927ca1f9476bd9e0bf13015c6c86515b0744a543

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-49122.exe

                                    Filesize

                                    184KB

                                    MD5

                                    f6111e7af1788430509b887c34f92c63

                                    SHA1

                                    78e0559f28046ca07502520892f1c687fc17c6aa

                                    SHA256

                                    c19d72ddac09d289b5be7f1010fb721f3afb37a6b91e1fe237038985417f61fc

                                    SHA512

                                    bade268276b8a8551934040ebc6859c08e1bf42b45ff9a4568a934dd30ce8503761d988d543925bc432875b9421942cfc8da07bb7e07795c737f75ccb4e93376

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-49646.exe

                                    Filesize

                                    184KB

                                    MD5

                                    91dbeb7802cf6d0f76e2b700cf8e7371

                                    SHA1

                                    cad6f06d7d0b1bac78cd99751acc58db58db0581

                                    SHA256

                                    9345e6931138b912628bdd861083f85be85296cd2fc91f8558c9d69b895215d1

                                    SHA512

                                    3178db5d4c7f4ec6ea681c5809463bceeb094173dcdf2fe6dda3ddc2c46e74ae5819badaaaeb5904e2c22a182d5a70fc3ad20d867ffff3ad7b63857e1d7f080b

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-4977.exe

                                    Filesize

                                    184KB

                                    MD5

                                    d9be113f928eb072c08ab2101dbf89e3

                                    SHA1

                                    0cf9d3c22f13506b99c57391abe9d1ddaccd23fe

                                    SHA256

                                    d2e4ce6b0ca405a91d3e6b771f47401d3545a1358efedc5bf29e2fbd50789b42

                                    SHA512

                                    4b7bcd83d943b9398699803b52a3cc560c6dfb4e40a4971981d9c4e4b5acf59fc45653977f4ae83829e290f779d05150c4245a58b6a37dbf64765a268464c9e1

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-53623.exe

                                    Filesize

                                    184KB

                                    MD5

                                    6166f9314a93f255e24d3218288859c0

                                    SHA1

                                    35a7c3e2a38d69a3b6f4186cde731b8e4842c151

                                    SHA256

                                    3d4905e343703b1e27ebf6bb1eb24b8ce1632721a1de805287ab49c3a84236bd

                                    SHA512

                                    98cfc5f0af030b5d7b31c301fcb272ea274b4018bbdb05dadc4e1c99b1feab12ea86bf7755eb558ed44e242897f5b22c9b7addc31b39ea6cae62341b3f844cae

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-56752.exe

                                    Filesize

                                    184KB

                                    MD5

                                    d5e2183102ea2df53a7d16439b8351d8

                                    SHA1

                                    9ca98a0842ab3c659cb30b3ae258b8de0864a49a

                                    SHA256

                                    b1b4301056aec674dc8f987a64c3c862fd470b6eb7fe3af223661a6249fe92b2

                                    SHA512

                                    e9e4b9c3cd40fab6cfa2b8741c4b6c1bab6417eb19252ca698fc23ed55af9704dda8b59580d9cf040801d9e73c0b1d637d178134078aaec6d6d6f6e2ccca6dab

                                  • \Users\Admin\AppData\Local\Temp\Unicorn-61.exe

                                    Filesize

                                    184KB

                                    MD5

                                    04f9da6730388d96d80ad5fdd06c7aa9

                                    SHA1

                                    22f2abe4686d994f0bcb72835f20801b054be485

                                    SHA256

                                    bcbe530aa363b8ff2dca89a60d612efbeb432cec217ad2f743ab306ec217fb8c

                                    SHA512

                                    8bff2ba8f56bb46945025281814924174c1da57ce63f92fb8af3d65b7422f596067b16977c61121cdcbf16b239761a03e1e8f3eb42b0dbcf6e640ff1361f1292