Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
24cc22632b7a816d642499e61c77d192.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
24cc22632b7a816d642499e61c77d192.exe
Resource
win10v2004-20231215-en
General
-
Target
24cc22632b7a816d642499e61c77d192.exe
-
Size
237KB
-
MD5
24cc22632b7a816d642499e61c77d192
-
SHA1
626f7251883b3dbca8566db16e1059ecf017d9a6
-
SHA256
7aafb869b8be4ef14da36bcbac6bd392da1596c57c134b595ab87b40e7a72f5f
-
SHA512
4d6a4d89e30007e6bc1c56bd8dcd774c3909214205714759bafbd844474584ffa414c110a586bf186e0510dc2206a0035d31bf210bc7d643ae4dc6157b9443e2
-
SSDEEP
1536:1f1zwQVgUAmEhSuWELl4Ec9ghMkhRsuJe2pzf1zwQVgvXS6f+:l1zwLNzhSuWEal9bkhRc2pb1zwLvX
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 11 IoCs
pid Process 2920 userinit.exe 2784 system.exe 2228 system.exe 2440 system.exe 2560 system.exe 1620 system.exe 2872 system.exe 2880 system.exe 2628 system.exe 1628 system.exe 2540 system.exe -
Loads dropped DLL 21 IoCs
pid Process 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe 2920 userinit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\userinit.exe 24cc22632b7a816d642499e61c77d192.exe File opened for modification C:\Windows\userinit.exe 24cc22632b7a816d642499e61c77d192.exe File created C:\Windows\kdcoms.dll userinit.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1884 24cc22632b7a816d642499e61c77d192.exe 2920 userinit.exe 2920 userinit.exe 2784 system.exe 2920 userinit.exe 2228 system.exe 2920 userinit.exe 2440 system.exe 2920 userinit.exe 2560 system.exe 2920 userinit.exe 1620 system.exe 2920 userinit.exe 2872 system.exe 2920 userinit.exe 2880 system.exe 2920 userinit.exe 2628 system.exe 2920 userinit.exe 1628 system.exe 2920 userinit.exe 2540 system.exe 2920 userinit.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1884 24cc22632b7a816d642499e61c77d192.exe 1884 24cc22632b7a816d642499e61c77d192.exe 2920 userinit.exe 2920 userinit.exe 2784 system.exe 2784 system.exe 2228 system.exe 2228 system.exe 2440 system.exe 2440 system.exe 2560 system.exe 2560 system.exe 1620 system.exe 1620 system.exe 2872 system.exe 2872 system.exe 2880 system.exe 2880 system.exe 2628 system.exe 2628 system.exe 1628 system.exe 1628 system.exe 2540 system.exe 2540 system.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2920 1884 24cc22632b7a816d642499e61c77d192.exe 16 PID 1884 wrote to memory of 2920 1884 24cc22632b7a816d642499e61c77d192.exe 16 PID 1884 wrote to memory of 2920 1884 24cc22632b7a816d642499e61c77d192.exe 16 PID 1884 wrote to memory of 2920 1884 24cc22632b7a816d642499e61c77d192.exe 16 PID 2920 wrote to memory of 2784 2920 userinit.exe 29 PID 2920 wrote to memory of 2784 2920 userinit.exe 29 PID 2920 wrote to memory of 2784 2920 userinit.exe 29 PID 2920 wrote to memory of 2784 2920 userinit.exe 29 PID 2920 wrote to memory of 2228 2920 userinit.exe 30 PID 2920 wrote to memory of 2228 2920 userinit.exe 30 PID 2920 wrote to memory of 2228 2920 userinit.exe 30 PID 2920 wrote to memory of 2228 2920 userinit.exe 30 PID 2920 wrote to memory of 2440 2920 userinit.exe 31 PID 2920 wrote to memory of 2440 2920 userinit.exe 31 PID 2920 wrote to memory of 2440 2920 userinit.exe 31 PID 2920 wrote to memory of 2440 2920 userinit.exe 31 PID 2920 wrote to memory of 2560 2920 userinit.exe 60 PID 2920 wrote to memory of 2560 2920 userinit.exe 60 PID 2920 wrote to memory of 2560 2920 userinit.exe 60 PID 2920 wrote to memory of 2560 2920 userinit.exe 60 PID 2920 wrote to memory of 1620 2920 userinit.exe 33 PID 2920 wrote to memory of 1620 2920 userinit.exe 33 PID 2920 wrote to memory of 1620 2920 userinit.exe 33 PID 2920 wrote to memory of 1620 2920 userinit.exe 33 PID 2920 wrote to memory of 2872 2920 userinit.exe 34 PID 2920 wrote to memory of 2872 2920 userinit.exe 34 PID 2920 wrote to memory of 2872 2920 userinit.exe 34 PID 2920 wrote to memory of 2872 2920 userinit.exe 34 PID 2920 wrote to memory of 2880 2920 userinit.exe 35 PID 2920 wrote to memory of 2880 2920 userinit.exe 35 PID 2920 wrote to memory of 2880 2920 userinit.exe 35 PID 2920 wrote to memory of 2880 2920 userinit.exe 35 PID 2920 wrote to memory of 2628 2920 userinit.exe 36 PID 2920 wrote to memory of 2628 2920 userinit.exe 36 PID 2920 wrote to memory of 2628 2920 userinit.exe 36 PID 2920 wrote to memory of 2628 2920 userinit.exe 36 PID 2920 wrote to memory of 1628 2920 userinit.exe 37 PID 2920 wrote to memory of 1628 2920 userinit.exe 37 PID 2920 wrote to memory of 1628 2920 userinit.exe 37 PID 2920 wrote to memory of 1628 2920 userinit.exe 37 PID 2920 wrote to memory of 2540 2920 userinit.exe 38 PID 2920 wrote to memory of 2540 2920 userinit.exe 38 PID 2920 wrote to memory of 2540 2920 userinit.exe 38 PID 2920 wrote to memory of 2540 2920 userinit.exe 38
Processes
-
C:\Windows\userinit.exeC:\Windows\userinit.exe1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2228
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2560
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
PID:2872
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:772
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2032
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1860
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:596
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1072
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1744
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1224
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2340
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1600
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:492
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2168
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1656
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1716
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2600
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2564
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2560
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2216
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2908
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:3056
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1908
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2852
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2252
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1076
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1940
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2276
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:892
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1744
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1224
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2348
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1600
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2324
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2152
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2496
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:896
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1616
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2116
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1732
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1576
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2740
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2616
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1988
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:3036
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2040
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2196
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1604
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1344
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2884
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2252
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:3028
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:3068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:968
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1684
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:288
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2272
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2408
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2028
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1496
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2512
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1856
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1132
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2236
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1556
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:828
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2584
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2620
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2608
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1988
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2896
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1548
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:3052
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2284
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2508
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2660
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1604
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2876
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2064
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1440
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2276
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2176
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1516
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1184
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1500
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:492
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2272
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:832
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2428
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2524
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2140
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:556
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2616
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1268
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2820
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2856
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2684
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2284
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1904
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1412
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2636
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:772
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2252
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1980
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:1492
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:584
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:2212
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:280
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe2⤵PID:332
-
-
C:\Users\Admin\AppData\Local\Temp\24cc22632b7a816d642499e61c77d192.exe"C:\Users\Admin\AppData\Local\Temp\24cc22632b7a816d642499e61c77d192.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD524cc22632b7a816d642499e61c77d192
SHA1626f7251883b3dbca8566db16e1059ecf017d9a6
SHA2567aafb869b8be4ef14da36bcbac6bd392da1596c57c134b595ab87b40e7a72f5f
SHA5124d6a4d89e30007e6bc1c56bd8dcd774c3909214205714759bafbd844474584ffa414c110a586bf186e0510dc2206a0035d31bf210bc7d643ae4dc6157b9443e2