Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
01c99fbbb5d50f074822c1708c8413e5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
01c99fbbb5d50f074822c1708c8413e5.exe
Resource
win10v2004-20231215-en
General
-
Target
01c99fbbb5d50f074822c1708c8413e5.exe
-
Size
249KB
-
MD5
01c99fbbb5d50f074822c1708c8413e5
-
SHA1
3a54e650b79129d3c760db9d54216e331ee5590d
-
SHA256
cff5eb284178d398145ca611e668f2b360e400a3fe4d88de0a69f4ffe8357502
-
SHA512
80a58fe2755d68887b74011bc6327724023a5a4fd2f98a1325b7c3957d23f254ba7269c5803f617ba919c7008aed701f5eceae959fee7ed1c1b70c04ec2444c7
-
SSDEEP
6144:uwcT8JFSLJZ9LZY4jZ5YBTohsD/TXyMnY/FQ+GCO:uVT8JFSFZ9L64jiohsD/7yh/FT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 804 sysconf.exe 2536 sysconf.exe 208 sysconf.exe 2372 sysconf.exe 4860 sysconf.exe 3992 sysconf.exe 1852 sysconf.exe 464 sysconf.exe 5116 sysconf.exe 4596 sysconf.exe 1872 sysconf.exe 3624 sysconf.exe 4656 sysconf.exe 4436 sysconf.exe 4304 sysconf.exe 1652 sysconf.exe 460 sysconf.exe 1180 sysconf.exe 1580 sysconf.exe 3476 sysconf.exe 2740 sysconf.exe 5116 sysconf.exe 4508 sysconf.exe 4824 sysconf.exe 3420 sysconf.exe 3760 sysconf.exe 900 sysconf.exe 4920 sysconf.exe 1016 sysconf.exe 3476 sysconf.exe 732 sysconf.exe 4468 sysconf.exe 4384 sysconf.exe 4960 sysconf.exe 4596 sysconf.exe 2544 sysconf.exe 376 sysconf.exe 1496 sysconf.exe 3356 sysconf.exe 4040 sysconf.exe 4976 sysconf.exe 3476 sysconf.exe 4056 sysconf.exe 4368 sysconf.exe 5116 sysconf.exe 4384 sysconf.exe 4388 sysconf.exe 5068 sysconf.exe 4720 sysconf.exe 336 sysconf.exe 876 sysconf.exe 3740 sysconf.exe 5108 sysconf.exe 2348 sysconf.exe 4976 sysconf.exe 5032 sysconf.exe 3404 sysconf.exe 4088 sysconf.exe 3420 sysconf.exe 4472 sysconf.exe 728 sysconf.exe 4728 sysconf.exe 3416 sysconf.exe 4040 sysconf.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe 01c99fbbb5d50f074822c1708c8413e5.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe File created C:\Windows\SysWOW64\sysconf.exe sysconf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 4784 01c99fbbb5d50f074822c1708c8413e5.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 804 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 2536 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 208 sysconf.exe 2372 sysconf.exe 2372 sysconf.exe 2372 sysconf.exe 2372 sysconf.exe 2372 sysconf.exe 2372 sysconf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 804 4784 01c99fbbb5d50f074822c1708c8413e5.exe 92 PID 4784 wrote to memory of 804 4784 01c99fbbb5d50f074822c1708c8413e5.exe 92 PID 4784 wrote to memory of 804 4784 01c99fbbb5d50f074822c1708c8413e5.exe 92 PID 804 wrote to memory of 2536 804 sysconf.exe 93 PID 804 wrote to memory of 2536 804 sysconf.exe 93 PID 804 wrote to memory of 2536 804 sysconf.exe 93 PID 2536 wrote to memory of 208 2536 sysconf.exe 96 PID 2536 wrote to memory of 208 2536 sysconf.exe 96 PID 2536 wrote to memory of 208 2536 sysconf.exe 96 PID 208 wrote to memory of 2372 208 sysconf.exe 99 PID 208 wrote to memory of 2372 208 sysconf.exe 99 PID 208 wrote to memory of 2372 208 sysconf.exe 99 PID 2372 wrote to memory of 4860 2372 sysconf.exe 100 PID 2372 wrote to memory of 4860 2372 sysconf.exe 100 PID 2372 wrote to memory of 4860 2372 sysconf.exe 100 PID 4860 wrote to memory of 3992 4860 sysconf.exe 101 PID 4860 wrote to memory of 3992 4860 sysconf.exe 101 PID 4860 wrote to memory of 3992 4860 sysconf.exe 101 PID 3992 wrote to memory of 1852 3992 sysconf.exe 103 PID 3992 wrote to memory of 1852 3992 sysconf.exe 103 PID 3992 wrote to memory of 1852 3992 sysconf.exe 103 PID 1852 wrote to memory of 464 1852 sysconf.exe 104 PID 1852 wrote to memory of 464 1852 sysconf.exe 104 PID 1852 wrote to memory of 464 1852 sysconf.exe 104 PID 464 wrote to memory of 5116 464 sysconf.exe 148 PID 464 wrote to memory of 5116 464 sysconf.exe 148 PID 464 wrote to memory of 5116 464 sysconf.exe 148 PID 5116 wrote to memory of 4596 5116 sysconf.exe 137 PID 5116 wrote to memory of 4596 5116 sysconf.exe 137 PID 5116 wrote to memory of 4596 5116 sysconf.exe 137 PID 4596 wrote to memory of 1872 4596 sysconf.exe 109 PID 4596 wrote to memory of 1872 4596 sysconf.exe 109 PID 4596 wrote to memory of 1872 4596 sysconf.exe 109 PID 1872 wrote to memory of 3624 1872 sysconf.exe 110 PID 1872 wrote to memory of 3624 1872 sysconf.exe 110 PID 1872 wrote to memory of 3624 1872 sysconf.exe 110 PID 3624 wrote to memory of 4656 3624 sysconf.exe 111 PID 3624 wrote to memory of 4656 3624 sysconf.exe 111 PID 3624 wrote to memory of 4656 3624 sysconf.exe 111 PID 4656 wrote to memory of 4436 4656 sysconf.exe 112 PID 4656 wrote to memory of 4436 4656 sysconf.exe 112 PID 4656 wrote to memory of 4436 4656 sysconf.exe 112 PID 4436 wrote to memory of 4304 4436 sysconf.exe 113 PID 4436 wrote to memory of 4304 4436 sysconf.exe 113 PID 4436 wrote to memory of 4304 4436 sysconf.exe 113 PID 4304 wrote to memory of 1652 4304 sysconf.exe 114 PID 4304 wrote to memory of 1652 4304 sysconf.exe 114 PID 4304 wrote to memory of 1652 4304 sysconf.exe 114 PID 1652 wrote to memory of 460 1652 sysconf.exe 115 PID 1652 wrote to memory of 460 1652 sysconf.exe 115 PID 1652 wrote to memory of 460 1652 sysconf.exe 115 PID 460 wrote to memory of 1180 460 sysconf.exe 116 PID 460 wrote to memory of 1180 460 sysconf.exe 116 PID 460 wrote to memory of 1180 460 sysconf.exe 116 PID 1180 wrote to memory of 1580 1180 sysconf.exe 118 PID 1180 wrote to memory of 1580 1180 sysconf.exe 118 PID 1180 wrote to memory of 1580 1180 sysconf.exe 118 PID 1580 wrote to memory of 3476 1580 sysconf.exe 145 PID 1580 wrote to memory of 3476 1580 sysconf.exe 145 PID 1580 wrote to memory of 3476 1580 sysconf.exe 145 PID 3476 wrote to memory of 2740 3476 sysconf.exe 120 PID 3476 wrote to memory of 2740 3476 sysconf.exe 120 PID 3476 wrote to memory of 2740 3476 sysconf.exe 120 PID 2740 wrote to memory of 5116 2740 sysconf.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe"C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"10⤵PID:5116
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"11⤵PID:4596
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"21⤵PID:3476
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"23⤵PID:5116
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4508 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4824 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"26⤵PID:3420
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3760 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:900 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4920 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1016 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"31⤵PID:3476
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:732 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4468 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"34⤵PID:4384
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4960 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:376 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3356 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"41⤵PID:4040
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"42⤵PID:4976
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"44⤵
- Executes dropped EXE
PID:4056 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"45⤵
- Executes dropped EXE
PID:4368 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4384 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4388 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4720 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:336 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5108 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5032 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3404 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3420 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4472 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:728 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4728 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3416 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"65⤵
- Executes dropped EXE
PID:4040 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"66⤵
- Drops file in System32 directory
PID:3120 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"67⤵
- Drops file in System32 directory
PID:3036 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"68⤵
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"69⤵
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"70⤵
- Drops file in System32 directory
PID:2612 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"71⤵
- Drops file in System32 directory
PID:4336 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"72⤵
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"73⤵
- Drops file in System32 directory
PID:4720 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"74⤵
- Drops file in System32 directory
PID:3244 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"75⤵
- Drops file in System32 directory
PID:336 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"76⤵
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"77⤵PID:3228
-
C:\Windows\SysWOW64\sysconf.exeC:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"78⤵PID:3332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD58eb870f771666a60433930ed7fe7c43a
SHA11949d62e0fb50dae24820873a7237ab5ff2686bb
SHA256246c39cc35014aae0fe7e4d3976eff7f506572afddaf5140350408b5a8ab9526
SHA512400755c107c61636dd41b13d620bb645295b72f2d269c072278d64df00c021a2dec146cbb55f0ba48c423640263453233f1654d0fd8120574c3dc4f9c02afbf2
-
Filesize
101KB
MD531b9f5001494dd6480dc461fb16763d6
SHA1a6ad253d94e2f204224f110870f1ca79a86a40f4
SHA256c339be4c22673c0fced89e88a6f1151a9290026f551e5ad332d461b11d4d7808
SHA512585ee17b6a16f036918e4f037e2f7fd7cbdf9761b61487408c9210bb592a010d9c72f3017c65879ef2950f9e6f0b0f239022fe1fa8a8aa3bd3d439b407f2dbbf
-
Filesize
17KB
MD529fcb3d695ae720a188975db055fc1c6
SHA118873efadaa2ea4351072c029b374cd5f7c6ffd2
SHA2565111eabc5e64488d6d6878d0457d6d0746933484dcdea22065640a6b57df0f0b
SHA512e5a17897d90f65f925d8acf036987d15da1c33abf97a8d496d9073bba28abb78010976447c4e12cd2442b244bb1d201ec946cd2120179f4d0dcae97d8a1955bf
-
Filesize
120KB
MD5453a88c494e979889f566b2918c0fef1
SHA1f87a64c6b2099d4d77264de397893878b4c954f4
SHA25643efcb7ef02f05f637c8dc4c40bfe69097fc552659558fae77370463ed10fc4c
SHA5129414f18e9e8ffe322de999c608dcf70bc82917b3bf1833258d83cc165288af964a3f341a4c44b6c5445823900e477dbd3845e91fe109b13e534b422dc07369ca
-
Filesize
150KB
MD5955d6812a8d480adf8c26388968329c7
SHA1cf04546566bf2a591de83b5a85e80ffbc5c47643
SHA2560239d9f55ed5c057a5a91e43f1dd6928690b8c415501d85d81c9f0fefc5cb244
SHA512f2f116b3afe00ba5160019bcace1991f7de998a28e393841105575a83ec42b6115024adbf6689cd317522ff54fe1b79e0b575cd93a508b0bab4551436a94c9ec
-
Filesize
124KB
MD5b33e45c2f85339a6c6c9c3bf1168ba9d
SHA14d8c8bd2a12b58245e9adb9a8c3aab6ae7a59244
SHA2563cee7d87c3e5631ca24493e26fe8f04402ce87b965dd0ccd8ba5e0bcfb7a50db
SHA5122433d57dead11b8da76da2fdd5116db7d3e64a6adff9ce671cff84964fbb27379935e8473718a1b1e9c04af3f82e89b623fa78ba817afc38a7041344e154cf5c
-
Filesize
85KB
MD58a8c454f8c73d606a90f22d849a89b3e
SHA11e26f89f9b198d735d5fd62714515d8f562d2684
SHA2568f24b475e87caa3de7474127c6c575cd1f01d00c1818692f511012d835097723
SHA51232a7203b50f20caae76cb397bbd314fb4598c41a152995c5c87ba08fc331b94a77a5efc70afb2bef345d56a0de4faa73e970344bc5aaa1f4a9ce4377b0acda0c
-
Filesize
47KB
MD536e047118c1e83b8191a094470924ffb
SHA14627939b8f24e91c870c1097e5daca7ba1cb6ee7
SHA2563b3f0410337b77a96e4d7a6a38d77b53f84f0352686588896f4f02e8e45dce31
SHA51206ee859199152b073ce7a2cb3f8df0534bba745058495781409f270cabe646fd2e374a56186db16776f299b1d5666b23900eedf416afdcab390fe9b7205e374d
-
Filesize
33KB
MD5509037ec8493f1cec7e2a74bc6096491
SHA189fca34db4e7636274a4c814cf2cb7d6184ee33d
SHA2564c26369aeb6055cc37caed38cf73615b49f808056a0b153e88b9a4a4a152d4b8
SHA512a16a966da42e1f63c752f511d140579bc69f2926bf51327792f17dd497a62508a822f604f7dbfb8039b2e2ba4ff8b1703d48651f5f391e837613b071e64133e9
-
Filesize
64KB
MD58dcb9d64f230d39f21e6bec14abb5268
SHA1685d66b65996de44e473d0b960e0f6f8a4daf031
SHA2561d6fad2ff63f8fdbab198f088d920cb15c579af9f02b7b1084a8098eeb348581
SHA512a636e20a8d48329d6ea4684d3133e71c819f5dd80af5623f438cb35039faea33b65b8b4deb51acb653b9d3eb7e333b3e4167d990007bec890863f16a619c019c
-
Filesize
65KB
MD5dad2e3ad17943a6ab072dd0512f59a97
SHA1582819bef28256e56917325e0e77100897b8fcb9
SHA256f6deb3d808098aa29777b6b968a09ada06a35a883d1277cd9cbe276793f5ac62
SHA512bcdb063e161203c4bba08a6f4d269a94381e626fae3694787e5efdfa4f44c7f4ef507b86c19e56ea2f3f26435dd6cd866befd0ac12a183d2084cac79ec874871
-
Filesize
46KB
MD51f226e6404a5e5e52502ad59127b8ea5
SHA12ffd54a6976444d706e9198056c3a08db1214fe8
SHA25682ea5e69c29f13114bd45c0e05253e33a19acf4443122a135226f777f726f86b
SHA512306a2ddd87e9db70d027a4c20375e815090f1df3d4ccbebf05b1536e2d29112e988623d85e615046f290bdd9bf77e71a26ce35ba1bb7d46aa64cc690f8ae82c4
-
Filesize
28KB
MD541a64ff69468b984191a42e2250fee85
SHA197ada5f426bb207b5df41475da7e6b16631eaadc
SHA2562ce0afea5ae989ad893320a1c2788ef16af6f59375b11557e7c450ec163a5bff
SHA51283283e41c3a6e072148cce8d869c0ba0f837b62684291d3b6d73172612e7b16f67cc0772e6a621bdb0a135e7add24d07cf9a165bc3dce8ecf16a65af07ebeb02
-
Filesize
23KB
MD50fea6f2b1026aed8af765a85f726b042
SHA18f0bd353e14924d3272ad03000f0ef0ebeec79bc
SHA256a41169f09c054cb1f067ff8fda7d65cf94565dfc09f791853d90468d929c8a5d
SHA512af17700727946e622cee26ad52b900b4082f9a0a1893bbe28c62ba3cc6f0707fc16c89e4b50a1b8e3d20720e9b2db49419e0b06b568e524e8f1f3fb560d3d5fc
-
Filesize
59KB
MD5e3d991bd73bc0e0b328bcdd6ba0fb485
SHA140c6ab48b37dbdfe9745df02bd59ee9dab046d0b
SHA25621ad404b567ea1f50a6d35dec350dbc9b3b6f05ded619be217d8501937b4f4da
SHA5123625f28168bd3dd43e3ece4f60e1280543f8fc225f050e1cccdf0f89ddabe1f2a2ef6286d734d9202b6a1b629faca0abe82898606f2083295110ab900b3e60d6
-
Filesize
31KB
MD50aa69079f6bf4e3fbe69d9544b72d107
SHA16053ef58f1852a2ead46b9152c4e9e6df8594af8
SHA256d028b125ea8dee9762a1a9cf744f71255e6d1c776f1de725326599a6119396f8
SHA5121cb82a2f0db3abb0ff98e71473b923f53e087cb02800471757d1f258ac7ab791ad1010ca32f54b306e77fc609a88dfeb886ce36f8aa1f53f6add167bd5d4ca58
-
Filesize
92KB
MD511d20b26db378a718b42daa2d771b0aa
SHA1d1ea7b26ad69c90d7e00ad200d1f4b9e9ea9cfd4
SHA256984753b93dc3c48b207a5cbeeb4d1097cea4fd7f68e2fd983152aef7cb99d095
SHA512da4ea3df3968a0f84fde1e18827ecff84964c167263352fd80bf4918cea21034e3465c66b048887c4275e92a23d90122bf4f695236584c0ab73518a8768ace2c
-
Filesize
191KB
MD52ee927d88d4da6a48844b6c4107323b7
SHA1cddc150518efb5e338efb725a856c2f15ddb2ae3
SHA256967c2449bb9173ff5ccd1e16ce2bcc634c6867384dfbfd34ded3e723cb46ef27
SHA51282d45a7c81b5611fb4b67c50541b052d0406dfbc806a12cb6652bf584a0a956421010c5e1e60505ef833a2cc1058ec262e0bb7fe894f3f32c22535da9b019075
-
Filesize
125KB
MD5712945c9ab62b7150ed3befc318af0d0
SHA1ab727e22bdc7ad7935f6c4edead90498f2563045
SHA256a52267a4a4b2e43c88f5e160d9fa6ff082f08260e2fed2d829a4aac5a615f2c9
SHA512f6c54d84976f632d63a0adad816cef973647423c661b5fa4fa3803767e590e8baa7e276b81a6608d766c6044d133534de9b6d4f9ec9f4dd88251e8cf49f54540
-
Filesize
249KB
MD5c0dc9d5f0799f688c1d0d888814e454e
SHA1bab6fc21f9d7537ff807054726e237d5aaa8d341
SHA2560ec771edfb3822e0929c614e6ca1c4ecb158a13b8181f260fbb3d3149e663182
SHA512a7510dce0c5c403ba6580df8d3562a2b55c0d1c9b1c1276a8ecf70d3a34cb7d0e2515bc88fd37b99afc93c04641869b685e8520fc4ba8741a3fc9e4162a996e2
-
Filesize
17KB
MD5e4455ffd41384ea2736b5ff35150695e
SHA17341600eb8f2a48658e826b72fab8ac9f25630e1
SHA256fdc947c691a50cec74b64f99af9cd74c489e71b2501ec888f1bc03f92c19ec05
SHA5126023fba688e8d25fc7d7eb2e1fb01f25bfda1c0c9de8b6c17d0d78c6e348471265c67a2341a3bcf1e135cdfdf2310b92d1bb6e6c7b44fe0675bb5ec83ac7d71d
-
Filesize
108KB
MD59f27aaef34e2e9fbbf3d7a918346e2a9
SHA10ac8c2bf389d4e50a402f01c070cfd2ae496f96c
SHA2562c5967081fd3e65140c05626249a79accef444fc10ef3b4001d886bf5d2bdf6c
SHA512177fd3d3e73d12ceeca12b726f7ccd96ac6448ccf74ae12788a7cc45c5ea5343cf0f969fbe0ff07e5c19403c30422779c0654334cb5c8fd5d416b2c77b69414d
-
Filesize
134KB
MD507282ef56759149b9b3c962f8a6739ab
SHA196d5ff4b1c4d506a3cda89ec4ad6efaf5911b81b
SHA256a01f41fb6af8e586a5a2269e1b3a8a2516aa8470e3a28aed9b44559f9b8844a3
SHA512abcc67357601b40d0e11ddac7400e8573c0e485cd672ecb69cfd6846e087014714be2cc0678e09747ffb0bc6d4386dc3f523f176e467e4d5852ad5383d22e444