Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 23:00
Behavioral task
behavioral1
Sample
fe7e6ab79f347ca092fcfd4c0c349dca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe7e6ab79f347ca092fcfd4c0c349dca.exe
Resource
win10v2004-20231215-en
General
-
Target
fe7e6ab79f347ca092fcfd4c0c349dca.exe
-
Size
651KB
-
MD5
fe7e6ab79f347ca092fcfd4c0c349dca
-
SHA1
e14d383c51074bd6073ae30f08306ebf10eaf27a
-
SHA256
22c0b06fc10fcc0244ca749e3ed55fcb3f6858178a5800a8cb98fd5ff28a0f02
-
SHA512
2cf78f968330ab6bbfc1dc7d4afb2dfde2dbfc48273bb95c8f5cc00c167e149bec5119073311dbc9b1c3ca94ee19df624c160229f27c3a21ba0fa4303e0c5341
-
SSDEEP
12288:kpyZT1lrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1ljOD3SxcDDcNDqWYurL0
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dHY4IvP3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiiemih.exe -
ModiLoader Second Stage 15 IoCs
resource yara_rule behavioral1/memory/2036-13-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral1/memory/2036-12-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral1/memory/2500-9-0x0000000000400000-0x000000000041C000-memory.dmp modiloader_stage2 behavioral1/memory/2808-67-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/files/0x00340000000144df-50.dat modiloader_stage2 behavioral1/memory/2036-77-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 behavioral1/memory/2944-80-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/2944-83-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/memory/2944-86-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/files/0x0007000000014719-89.dat modiloader_stage2 behavioral1/files/0x0007000000014719-87.dat modiloader_stage2 behavioral1/memory/2316-109-0x0000000000400000-0x000000000041B000-memory.dmp modiloader_stage2 behavioral1/files/0x0007000000014719-116.dat modiloader_stage2 behavioral1/memory/2036-125-0x0000000000580000-0x00000000005E4000-memory.dmp modiloader_stage2 behavioral1/memory/2036-193-0x0000000000400000-0x0000000000507000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2024 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 2748 dHY4IvP3.exe 2816 hiiemih.exe 2808 azhost.exe 1532 azhost.exe 2944 bzhost.exe 2316 czhost.exe 2288 czhost.exe 2004 dzhost.exe 336 csrss.exe 1164 ezhost.exe -
Loads dropped DLL 18 IoCs
pid Process 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2748 dHY4IvP3.exe 2748 dHY4IvP3.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe -
resource yara_rule behavioral1/memory/2036-13-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-12-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-11-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-5-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-3-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-2-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2036-77-0x0000000000400000-0x0000000000507000-memory.dmp upx behavioral1/memory/2288-103-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2288-113-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2288-112-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2288-111-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2288-100-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2288-98-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2036-193-0x0000000000400000-0x0000000000507000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /l" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /o" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /A" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /b" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /j" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /G" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /Z" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /N" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /U" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /e" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /R" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /y" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /c" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /t" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /r" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /m" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /v" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /K" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /W" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /z" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /i" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /Q" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /I" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /J" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /T" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /X" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /n" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /V" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /B" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /h" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /Y" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /C" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /b" dHY4IvP3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /w" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /f" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /s" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /L" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /x" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /S" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /F" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /u" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /M" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /g" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /p" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /k" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /O" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /q" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /H" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /d" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /E" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /P" hiiemih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiiemih = "C:\\Users\\Admin\\hiiemih.exe /a" hiiemih.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum azhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 azhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2500 set thread context of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2808 set thread context of 1532 2808 azhost.exe 36 PID 2316 set thread context of 2288 2316 czhost.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 1988 2288 WerFault.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2812 tasklist.exe 668 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 dHY4IvP3.exe 2748 dHY4IvP3.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe 1532 azhost.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 2816 hiiemih.exe 1532 azhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2812 tasklist.exe Token: SeDebugPrivilege 2004 dzhost.exe Token: SeDebugPrivilege 2004 dzhost.exe Token: SeDebugPrivilege 668 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 2748 dHY4IvP3.exe 2816 hiiemih.exe 1164 ezhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2500 wrote to memory of 2036 2500 fe7e6ab79f347ca092fcfd4c0c349dca.exe 28 PID 2036 wrote to memory of 2748 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 29 PID 2036 wrote to memory of 2748 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 29 PID 2036 wrote to memory of 2748 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 29 PID 2036 wrote to memory of 2748 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 29 PID 2748 wrote to memory of 2816 2748 dHY4IvP3.exe 34 PID 2748 wrote to memory of 2816 2748 dHY4IvP3.exe 34 PID 2748 wrote to memory of 2816 2748 dHY4IvP3.exe 34 PID 2748 wrote to memory of 2816 2748 dHY4IvP3.exe 34 PID 2748 wrote to memory of 2712 2748 dHY4IvP3.exe 33 PID 2748 wrote to memory of 2712 2748 dHY4IvP3.exe 33 PID 2748 wrote to memory of 2712 2748 dHY4IvP3.exe 33 PID 2748 wrote to memory of 2712 2748 dHY4IvP3.exe 33 PID 2712 wrote to memory of 2812 2712 cmd.exe 30 PID 2712 wrote to memory of 2812 2712 cmd.exe 30 PID 2712 wrote to memory of 2812 2712 cmd.exe 30 PID 2712 wrote to memory of 2812 2712 cmd.exe 30 PID 2036 wrote to memory of 2808 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 35 PID 2036 wrote to memory of 2808 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 35 PID 2036 wrote to memory of 2808 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 35 PID 2036 wrote to memory of 2808 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 35 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2808 wrote to memory of 1532 2808 azhost.exe 36 PID 2036 wrote to memory of 2944 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 37 PID 2036 wrote to memory of 2944 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 37 PID 2036 wrote to memory of 2944 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 37 PID 2036 wrote to memory of 2944 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 37 PID 2036 wrote to memory of 2316 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 38 PID 2036 wrote to memory of 2316 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 38 PID 2036 wrote to memory of 2316 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 38 PID 2036 wrote to memory of 2316 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 38 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2316 wrote to memory of 2288 2316 czhost.exe 40 PID 2288 wrote to memory of 1988 2288 czhost.exe 39 PID 2288 wrote to memory of 1988 2288 czhost.exe 39 PID 2288 wrote to memory of 1988 2288 czhost.exe 39 PID 2288 wrote to memory of 1988 2288 czhost.exe 39 PID 2036 wrote to memory of 2004 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 41 PID 2036 wrote to memory of 2004 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 41 PID 2036 wrote to memory of 2004 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 41 PID 2036 wrote to memory of 2004 2036 fe7e6ab79f347ca092fcfd4c0c349dca.exe 41 PID 2004 wrote to memory of 336 2004 dzhost.exe 26 PID 2004 wrote to memory of 1456 2004 dzhost.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exefe7e6ab79f347ca092fcfd4c0c349dca.exe2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\dHY4IvP3.exeC:\Users\Admin\dHY4IvP3.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del dHY4IvP3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2712
-
-
C:\Users\Admin\hiiemih.exe"C:\Users\Admin\hiiemih.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
-
C:\Users\Admin\azhost.exeC:\Users\Admin\azhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\azhost.exeazhost.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
-
C:\Users\Admin\bzhost.exeC:\Users\Admin\bzhost.exe3⤵
- Executes dropped EXE
PID:2944
-
-
C:\Users\Admin\czhost.exeC:\Users\Admin\czhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\czhost.execzhost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288
-
-
-
C:\Users\Admin\dzhost.exeC:\Users\Admin\dzhost.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1456
-
-
-
C:\Users\Admin\ezhost.exeC:\Users\Admin\ezhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del fe7e6ab79f347ca092fcfd4c0c349dca.exe3⤵
- Deletes itself
PID:2024 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:876
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2332
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336
-
C:\Windows\SysWOW64\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 881⤵
- Loads dropped DLL
- Program crash
PID:1988
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:3068
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD527ef898ce7ec9c0b79a6996a0b419de1
SHA14e8aed756fbc6133af13028c33366d2eaa43f954
SHA256f08df8dd8e3fe3de4a1ba4ba3bd355a233cf7febd5917b982ec5a949726c36a6
SHA5125c7fa67e7ed1e8ce238e58f0b55618d1fc13af4e19d9267f6e88e277beb2f10e6c0f0027a532a2d1d4b6e40da1b31dfcacf50ccb71a75dc231ff876869b6787a
-
Filesize
3KB
MD5bf443ad3602f739cff0761735af0fba6
SHA163788512c02ef7c9a256fa869c1f1c45b7a364ad
SHA256a86b9cada68d7c8a66cb54cc057c64cda216fd898330a5da2324539bbbfbcd26
SHA512285fe01c816646661531f323653c4a1d58d39c45d94a022e79f809fdde9b3cbd686167f002fc6acc850059d65f237e5b7bd0fcc43aba70ce1522a895371220d6
-
Filesize
2KB
MD5075e642a0ed6ab1c7f3fbf781f5c9b3b
SHA1f0684fd9f749007b88ee523832092db2bbb945c9
SHA256d183cb535895325015c5420ac097b829d7781cd1e9167b899df2bbd48bee8abd
SHA512a689f620533c90521c406d60ab9408c7a0983e3a70697c9c731abd81e2cd361315c1398d5ac30128d29678b4c47cd252e79e83f3fe94de7935371ef63df67aa1
-
Filesize
96KB
MD5fb7e8882346223dfbad778b5a7f74f32
SHA18285032fbab2f9f52533657d46df457ab64d0e15
SHA2566d6fa60b26cd2fc87c94afb20e7f3b35d6eca76d5a46191b8df802d30d4cbc3e
SHA51231e3963dd156da4a57b3ffd37b857ee1d433c61dc22eb56356f2171b282f3735a1c31d65b3a0b431151b55bfebf964f82c5aa13a12f1c2a8a580840a7ea5da32
-
Filesize
64KB
MD5f1e45295dc0a7c93694c4144ae9da6af
SHA1d08f17bcce31eebfc1ff804515cd038a0570ae68
SHA2569e0afe0ac8f438913a9de0f3efb6027777f27b5522dc648c9933b43c26dbd468
SHA5120e927f12a5a5a2e16b4b632e321dc695064b4502fd695f6d8d5390626c4c20705091206cb8650503abdc55c12a760e17d7dbb589bf34c4f75479afc309f1ea38
-
Filesize
221KB
MD55b414fb77d0dbec97ee529ec0bbcbeaf
SHA1359cd24cd341f75eb46b99375824f6b649443f8e
SHA25662027b13d4918e5e644952c977960a5e6dfe241e2bb35b387de0bfd0b752e882
SHA512887b1b93e51d21927ffba49536f281003eef1dbee7634a08cab256f07701d54fe755acab7ae4a513c754067e4144c44c3580689ce187fd584ba440ab748a2360
-
Filesize
288KB
MD524b65d3bfefa977fc57ee2f5c4a4a7f7
SHA1098f1c85067be307ec2dc26a8efe35a5580c67ce
SHA2567da4220af5b9d6527988ccf80d66ccb13dac6a11ed0bfc114d23739d80a47a4b
SHA512690963d7321f9471a8d579cc2fddac562ab790cf1b635079bfca1f4264111aa7aecaeaa0d75462bd018aa3ec4d472075a6156132cd73ded5fc9c77794a4021b4