Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
462507f254269c493bba5d6b953b6117.exe
Resource
win7-20231129-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
462507f254269c493bba5d6b953b6117.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
462507f254269c493bba5d6b953b6117.exe
-
Size
456KB
-
MD5
462507f254269c493bba5d6b953b6117
-
SHA1
05a2ea36621beff172e1db99594dec2b679ea8a9
-
SHA256
7b9a2506298ce1632a7f3233d5d83d22b89a257715204b1e64bfdf61784751c9
-
SHA512
968722ed35e4ab6742e0de6f44407636750968a65d62ec8f88242b84eeb6dcc4204500608d05fafbb6f520623730282418aa14eff2f20cbc66a68ce38fd9bfb8
-
SSDEEP
12288:z4ik34n1GxipPy4ZNj2mOb/DNlq41TzXe9Yv:z4ik34n15iN/5lq41Tzuq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" u8kSVi.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" muabae.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8kSVi.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 462507f254269c493bba5d6b953b6117.exe -
Executes dropped EXE 6 IoCs
pid Process 3924 u8kSVi.exe 1352 muabae.exe 636 alay.exe 888 alay.exe 2724 dlay.exe 4152 flay.exe -
resource yara_rule behavioral2/memory/888-47-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/888-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/888-51-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/888-50-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /l" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /U" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /W" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /a" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /F" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /c" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /T" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /S" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /e" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /I" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /p" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /m" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /V" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /x" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /P" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /g" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /K" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /Y" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /Q" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /z" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /A" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /h" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /X" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /Z" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /b" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /i" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /O" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /q" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /d" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /j" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /C" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /E" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /M" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /z" u8kSVi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /L" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /f" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /N" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /y" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /n" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /J" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /v" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /R" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /o" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /w" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /G" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /r" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /t" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /D" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /H" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /u" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /s" muabae.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muabae = "C:\\Users\\Admin\\muabae.exe /k" muabae.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 636 set thread context of 888 636 alay.exe 100 PID 4152 set thread context of 3816 4152 flay.exe 110 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 760 tasklist.exe 1492 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3924 u8kSVi.exe 3924 u8kSVi.exe 3924 u8kSVi.exe 3924 u8kSVi.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe 888 alay.exe 888 alay.exe 888 alay.exe 888 alay.exe 1352 muabae.exe 1352 muabae.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 760 tasklist.exe Token: SeDebugPrivilege 4152 flay.exe Token: SeDebugPrivilege 1492 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1672 462507f254269c493bba5d6b953b6117.exe 3924 u8kSVi.exe 1352 muabae.exe 636 alay.exe 2724 dlay.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3924 1672 462507f254269c493bba5d6b953b6117.exe 27 PID 1672 wrote to memory of 3924 1672 462507f254269c493bba5d6b953b6117.exe 27 PID 1672 wrote to memory of 3924 1672 462507f254269c493bba5d6b953b6117.exe 27 PID 3924 wrote to memory of 1352 3924 u8kSVi.exe 103 PID 3924 wrote to memory of 1352 3924 u8kSVi.exe 103 PID 3924 wrote to memory of 1352 3924 u8kSVi.exe 103 PID 3924 wrote to memory of 5116 3924 u8kSVi.exe 97 PID 3924 wrote to memory of 5116 3924 u8kSVi.exe 97 PID 3924 wrote to memory of 5116 3924 u8kSVi.exe 97 PID 5116 wrote to memory of 760 5116 cmd.exe 98 PID 5116 wrote to memory of 760 5116 cmd.exe 98 PID 5116 wrote to memory of 760 5116 cmd.exe 98 PID 1672 wrote to memory of 636 1672 462507f254269c493bba5d6b953b6117.exe 101 PID 1672 wrote to memory of 636 1672 462507f254269c493bba5d6b953b6117.exe 101 PID 1672 wrote to memory of 636 1672 462507f254269c493bba5d6b953b6117.exe 101 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 636 wrote to memory of 888 636 alay.exe 100 PID 1672 wrote to memory of 2724 1672 462507f254269c493bba5d6b953b6117.exe 99 PID 1672 wrote to memory of 2724 1672 462507f254269c493bba5d6b953b6117.exe 99 PID 1672 wrote to memory of 2724 1672 462507f254269c493bba5d6b953b6117.exe 99 PID 1672 wrote to memory of 4152 1672 462507f254269c493bba5d6b953b6117.exe 109 PID 1672 wrote to memory of 4152 1672 462507f254269c493bba5d6b953b6117.exe 109 PID 1672 wrote to memory of 4152 1672 462507f254269c493bba5d6b953b6117.exe 109 PID 4152 wrote to memory of 3816 4152 flay.exe 110 PID 4152 wrote to memory of 3816 4152 flay.exe 110 PID 4152 wrote to memory of 3816 4152 flay.exe 110 PID 4152 wrote to memory of 3816 4152 flay.exe 110 PID 1672 wrote to memory of 1772 1672 462507f254269c493bba5d6b953b6117.exe 112 PID 1672 wrote to memory of 1772 1672 462507f254269c493bba5d6b953b6117.exe 112 PID 1672 wrote to memory of 1772 1672 462507f254269c493bba5d6b953b6117.exe 112 PID 1772 wrote to memory of 1492 1772 cmd.exe 114 PID 1772 wrote to memory of 1492 1772 cmd.exe 114 PID 1772 wrote to memory of 1492 1772 cmd.exe 114 PID 1352 wrote to memory of 1492 1352 muabae.exe 114 PID 1352 wrote to memory of 1492 1352 muabae.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\462507f254269c493bba5d6b953b6117.exe"C:\Users\Admin\AppData\Local\Temp\462507f254269c493bba5d6b953b6117.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\u8kSVi.exeC:\Users\Admin\u8kSVi.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del u8kSVi.exe3⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
C:\Users\Admin\muabae.exe"C:\Users\Admin\muabae.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
-
-
-
C:\Users\Admin\dlay.exeC:\Users\Admin\dlay.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
C:\Users\Admin\alay.exeC:\Users\Admin\alay.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
-
-
C:\Users\Admin\flay.exeC:\Users\Admin\flay.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 462507f254269c493bba5d6b953b6117.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
-
C:\Users\Admin\alay.exe"C:\Users\Admin\alay.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD59b3122a0ed7ec1eb344be414036da288
SHA1cf6a4651b24fc71db61e1870a360c3fa7d67c1ca
SHA256ca0ae1bd6a5328945c7805621a2efe10840b3023f70e180750ed0f9f87cc7df7
SHA512f57046121b54c8abd81bade8c2989530ac604e128c826397df63680fc7d8bc22715408613119bfa11920e736a7185950adf3d6c769df3f9b389d1020b22959e4
-
Filesize
248KB
MD56db55c3ba8df8277df716c0835a42f22
SHA1edc67cddd103f225cf48dc6861490d647ad0594c
SHA256e42eb0f62db757e26a2da73e86d0557de6d4b21d8ca4c499ad3496bd0abf4bca
SHA512c233ba8da0dde812da78bcb8b185d786a6760b4992516b42b5f2758d8a2a429122315b7a0deb410b76fa854c4d20b2162ad9b1985aa0726e7ee727f87a019449
-
Filesize
92KB
MD59f850f4e82bef45fea9483e1e868dca1
SHA1bd6d9fa85598f1d67f2ca86fea26f6e2c03f16e0
SHA2564963febf705be29dd5bb96b23c9ce8ce07ca8d62f2af5ca7df90f1f60c5b01a3
SHA51263361a2bdb30fe45cd9d440feda69c729394e5a25e23be052863bc002d65787bf1b770f3e070d08db7b1d22353be15ea8db7b78384ed7a9bd8088c34fd6ccb05
-
Filesize
248KB
MD576a6dee598367ca2ce4e90457622eb62
SHA1067b85364f34f26292739ea3c04706335c7a9ee4
SHA2562bae3eab43e8f1761f7aa29d259d9966bc8d8f19303a53f57b7d1d4e9b11929d
SHA5128125d4643b0cb63496eae85fae0907bb36c82100fd35af76dadb787b82af7d4014f071e63e2bf07021145786e11a64662693c0502cc2ba6df31a4be917c0474f
-
Filesize
92KB
MD5911d9773771430d57a8a2f4044a57d8b
SHA13cc990ffe0ae1f6d4bb85c44c1a5a706ced6cecf
SHA2562d63355a3f1fdfa6c0aef1d69c9284eb240ab57350920d0b937b2b85e0d5b495
SHA51270f36df90e4a47d541d56a1ba05af0ec8d310188247ba445a1a9fe99da8530f5ec14e6d2fba26d3badc43c0e5ee4b2fde9f85d62ba020f39d440ddc033370bb9