Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6ec699b6839f02fec298d786d95244e.exe
Resource
win7-20231215-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
e6ec699b6839f02fec298d786d95244e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
e6ec699b6839f02fec298d786d95244e.exe
-
Size
2.5MB
-
MD5
e6ec699b6839f02fec298d786d95244e
-
SHA1
f1c26f1a8729f075f2f49c849be1d8b817bf1b6c
-
SHA256
d86c9114ecca7a31539278705d7e50f9674a562e1382a6053e735d9d2b30942a
-
SHA512
e579bbaa11529b8bdcb33771ef39e1b1461aa927bf7ce7f24c633aff2b14fe5367e0bdb259354942a7d95f82f34960f110a1bfad1db55b819de486f1a6d4971c
-
SSDEEP
1536:Hn/Ay6PcOtb0LO6kWkVc/HfvfNdmNzyrhe:Hn/A7
Score
10/10
Malware Config
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" e6ec699b6839f02fec298d786d95244e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" e6ec699b6839f02fec298d786d95244e.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe = "0" e6ec699b6839f02fec298d786d95244e.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Nirsoft 1 IoCs
resource yara_rule behavioral1/files/0x000c000000012695-7.dat Nirsoft -
Renames multiple (212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1992 wbadmin.exe -
Executes dropped EXE 4 IoCs
pid Process 2776 AdvancedRun.exe 2384 AdvancedRun.exe 1656 AdvancedRun.exe 1376 AdvancedRun.exe -
Loads dropped DLL 7 IoCs
pid Process 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2776 AdvancedRun.exe 2776 AdvancedRun.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 1656 AdvancedRun.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" e6ec699b6839f02fec298d786d95244e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths e6ec699b6839f02fec298d786d95244e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe = "0" e6ec699b6839f02fec298d786d95244e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" e6ec699b6839f02fec298d786d95244e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" e6ec699b6839f02fec298d786d95244e.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: e6ec699b6839f02fec298d786d95244e.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
pid Process 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2896 set thread context of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2868 set thread context of 1632 2868 e6ec699b6839f02fec298d786d95244e.exe 58 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\readme.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt e6ec699b6839f02fec298d786d95244e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui e6ec699b6839f02fec298d786d95244e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2636 2896 WerFault.exe 27 -
Delays execution with timeout.exe 2 IoCs
pid Process 2632 timeout.exe 2752 timeout.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3008 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2776 AdvancedRun.exe 2776 AdvancedRun.exe 2384 AdvancedRun.exe 2384 AdvancedRun.exe 2676 powershell.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 2896 e6ec699b6839f02fec298d786d95244e.exe 1656 AdvancedRun.exe 1656 AdvancedRun.exe 1376 AdvancedRun.exe 1376 AdvancedRun.exe 2992 e6ec699b6839f02fec298d786d95244e.exe 3068 powershell.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe 2868 e6ec699b6839f02fec298d786d95244e.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeDebugPrivilege 2776 AdvancedRun.exe Token: SeImpersonatePrivilege 2776 AdvancedRun.exe Token: SeDebugPrivilege 2384 AdvancedRun.exe Token: SeImpersonatePrivilege 2384 AdvancedRun.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 2896 e6ec699b6839f02fec298d786d95244e.exe Token: SeBackupPrivilege 1684 vssvc.exe Token: SeRestorePrivilege 1684 vssvc.exe Token: SeAuditPrivilege 1684 vssvc.exe Token: SeDebugPrivilege 1656 AdvancedRun.exe Token: SeImpersonatePrivilege 1656 AdvancedRun.exe Token: SeDebugPrivilege 1376 AdvancedRun.exe Token: SeImpersonatePrivilege 1376 AdvancedRun.exe Token: SeBackupPrivilege 1948 wbengine.exe Token: SeRestorePrivilege 1948 wbengine.exe Token: SeSecurityPrivilege 1948 wbengine.exe Token: SeIncreaseQuotaPrivilege 796 WMIC.exe Token: SeSecurityPrivilege 796 WMIC.exe Token: SeTakeOwnershipPrivilege 796 WMIC.exe Token: SeLoadDriverPrivilege 796 WMIC.exe Token: SeSystemProfilePrivilege 796 WMIC.exe Token: SeSystemtimePrivilege 796 WMIC.exe Token: SeProfSingleProcessPrivilege 796 WMIC.exe Token: SeIncBasePriorityPrivilege 796 WMIC.exe Token: SeCreatePagefilePrivilege 796 WMIC.exe Token: SeBackupPrivilege 796 WMIC.exe Token: SeRestorePrivilege 796 WMIC.exe Token: SeShutdownPrivilege 796 WMIC.exe Token: SeDebugPrivilege 796 WMIC.exe Token: SeSystemEnvironmentPrivilege 796 WMIC.exe Token: SeRemoteShutdownPrivilege 796 WMIC.exe Token: SeUndockPrivilege 796 WMIC.exe Token: SeManageVolumePrivilege 796 WMIC.exe Token: 33 796 WMIC.exe Token: 34 796 WMIC.exe Token: 35 796 WMIC.exe Token: SeIncreaseQuotaPrivilege 796 WMIC.exe Token: SeSecurityPrivilege 796 WMIC.exe Token: SeTakeOwnershipPrivilege 796 WMIC.exe Token: SeLoadDriverPrivilege 796 WMIC.exe Token: SeSystemProfilePrivilege 796 WMIC.exe Token: SeSystemtimePrivilege 796 WMIC.exe Token: SeProfSingleProcessPrivilege 796 WMIC.exe Token: SeIncBasePriorityPrivilege 796 WMIC.exe Token: SeCreatePagefilePrivilege 796 WMIC.exe Token: SeBackupPrivilege 796 WMIC.exe Token: SeRestorePrivilege 796 WMIC.exe Token: SeShutdownPrivilege 796 WMIC.exe Token: SeDebugPrivilege 796 WMIC.exe Token: SeSystemEnvironmentPrivilege 796 WMIC.exe Token: SeRemoteShutdownPrivilege 796 WMIC.exe Token: SeUndockPrivilege 796 WMIC.exe Token: SeManageVolumePrivilege 796 WMIC.exe Token: 33 796 WMIC.exe Token: 34 796 WMIC.exe Token: 35 796 WMIC.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 2868 e6ec699b6839f02fec298d786d95244e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2776 2896 e6ec699b6839f02fec298d786d95244e.exe 28 PID 2896 wrote to memory of 2776 2896 e6ec699b6839f02fec298d786d95244e.exe 28 PID 2896 wrote to memory of 2776 2896 e6ec699b6839f02fec298d786d95244e.exe 28 PID 2896 wrote to memory of 2776 2896 e6ec699b6839f02fec298d786d95244e.exe 28 PID 2776 wrote to memory of 2384 2776 AdvancedRun.exe 29 PID 2776 wrote to memory of 2384 2776 AdvancedRun.exe 29 PID 2776 wrote to memory of 2384 2776 AdvancedRun.exe 29 PID 2776 wrote to memory of 2384 2776 AdvancedRun.exe 29 PID 2896 wrote to memory of 2676 2896 e6ec699b6839f02fec298d786d95244e.exe 30 PID 2896 wrote to memory of 2676 2896 e6ec699b6839f02fec298d786d95244e.exe 30 PID 2896 wrote to memory of 2676 2896 e6ec699b6839f02fec298d786d95244e.exe 30 PID 2896 wrote to memory of 2676 2896 e6ec699b6839f02fec298d786d95244e.exe 30 PID 2896 wrote to memory of 2488 2896 e6ec699b6839f02fec298d786d95244e.exe 32 PID 2896 wrote to memory of 2488 2896 e6ec699b6839f02fec298d786d95244e.exe 32 PID 2896 wrote to memory of 2488 2896 e6ec699b6839f02fec298d786d95244e.exe 32 PID 2896 wrote to memory of 2488 2896 e6ec699b6839f02fec298d786d95244e.exe 32 PID 2488 wrote to memory of 2632 2488 cmd.exe 34 PID 2488 wrote to memory of 2632 2488 cmd.exe 34 PID 2488 wrote to memory of 2632 2488 cmd.exe 34 PID 2488 wrote to memory of 2632 2488 cmd.exe 34 PID 2896 wrote to memory of 2996 2896 e6ec699b6839f02fec298d786d95244e.exe 45 PID 2896 wrote to memory of 2996 2896 e6ec699b6839f02fec298d786d95244e.exe 45 PID 2896 wrote to memory of 2996 2896 e6ec699b6839f02fec298d786d95244e.exe 45 PID 2896 wrote to memory of 2996 2896 e6ec699b6839f02fec298d786d95244e.exe 45 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2992 2896 e6ec699b6839f02fec298d786d95244e.exe 44 PID 2896 wrote to memory of 2636 2896 e6ec699b6839f02fec298d786d95244e.exe 35 PID 2896 wrote to memory of 2636 2896 e6ec699b6839f02fec298d786d95244e.exe 35 PID 2896 wrote to memory of 2636 2896 e6ec699b6839f02fec298d786d95244e.exe 35 PID 2896 wrote to memory of 2636 2896 e6ec699b6839f02fec298d786d95244e.exe 35 PID 2992 wrote to memory of 2872 2992 e6ec699b6839f02fec298d786d95244e.exe 40 PID 2992 wrote to memory of 2872 2992 e6ec699b6839f02fec298d786d95244e.exe 40 PID 2992 wrote to memory of 2872 2992 e6ec699b6839f02fec298d786d95244e.exe 40 PID 2992 wrote to memory of 2872 2992 e6ec699b6839f02fec298d786d95244e.exe 40 PID 2872 wrote to memory of 3008 2872 cmd.exe 39 PID 2872 wrote to memory of 3008 2872 cmd.exe 39 PID 2872 wrote to memory of 3008 2872 cmd.exe 39 PID 2868 wrote to memory of 1656 2868 e6ec699b6839f02fec298d786d95244e.exe 42 PID 2868 wrote to memory of 1656 2868 e6ec699b6839f02fec298d786d95244e.exe 42 PID 2868 wrote to memory of 1656 2868 e6ec699b6839f02fec298d786d95244e.exe 42 PID 2868 wrote to memory of 1656 2868 e6ec699b6839f02fec298d786d95244e.exe 42 PID 1656 wrote to memory of 1376 1656 AdvancedRun.exe 41 PID 1656 wrote to memory of 1376 1656 AdvancedRun.exe 41 PID 1656 wrote to memory of 1376 1656 AdvancedRun.exe 41 PID 1656 wrote to memory of 1376 1656 AdvancedRun.exe 41 PID 2872 wrote to memory of 1992 2872 cmd.exe 51 PID 2872 wrote to memory of 1992 2872 cmd.exe 51 PID 2872 wrote to memory of 1992 2872 cmd.exe 51 PID 2872 wrote to memory of 796 2872 cmd.exe 49 PID 2872 wrote to memory of 796 2872 cmd.exe 49 PID 2872 wrote to memory of 796 2872 cmd.exe 49 PID 2868 wrote to memory of 3068 2868 e6ec699b6839f02fec298d786d95244e.exe 57 PID 2868 wrote to memory of 3068 2868 e6ec699b6839f02fec298d786d95244e.exe 57 PID 2868 wrote to memory of 3068 2868 e6ec699b6839f02fec298d786d95244e.exe 57 PID 2868 wrote to memory of 3068 2868 e6ec699b6839f02fec298d786d95244e.exe 57 PID 2868 wrote to memory of 2600 2868 e6ec699b6839f02fec298d786d95244e.exe 55 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\ed811e4f-b503-4917-9e09-401cc5a72d0c\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ed811e4f-b503-4917-9e09-401cc5a72d0c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ed811e4f-b503-4917-9e09-401cc5a72d0c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\ed811e4f-b503-4917-9e09-401cc5a72d0c\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ed811e4f-b503-4917-9e09-401cc5a72d0c\AdvancedRun.exe" /SpecialRun 4101d8 27763⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 10042⤵
- Program crash
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"2⤵PID:2996
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Interacts with shadow copies
PID:3008
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet2⤵
- Deletes backup catalog
PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\8ebb0aa6-e7e8-4e77-bb66-7f879586b20f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\8ebb0aa6-e7e8-4e77-bb66-7f879586b20f\AdvancedRun.exe" /SpecialRun 4101d8 16561⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
C:\Users\Admin\AppData\Local\Temp\8ebb0aa6-e7e8-4e77-bb66-7f879586b20f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\8ebb0aa6-e7e8-4e77-bb66-7f879586b20f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8ebb0aa6-e7e8-4e77-bb66-7f879586b20f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
-
C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe" n29921⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵PID:2600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe" -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"C:\Users\Admin\AppData\Local\Temp\e6ec699b6839f02fec298d786d95244e.exe"2⤵PID:1632
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1928
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2940
-
C:\Windows\SysWOW64\timeout.exetimeout 11⤵
- Delays execution with timeout.exe
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a