Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
2484ae3c3b81170f75e6ee512c04e14a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2484ae3c3b81170f75e6ee512c04e14a.exe
Resource
win10v2004-20231215-en
General
-
Target
2484ae3c3b81170f75e6ee512c04e14a.exe
-
Size
156KB
-
MD5
2484ae3c3b81170f75e6ee512c04e14a
-
SHA1
cf49513796222e75e7f8ce53f30939059762324e
-
SHA256
ba0bbaddf18f94738a211534ebdeb4b9b9722996f2570e09fbd0a9eac85f14fa
-
SHA512
63b431e63650fa6f48d459ab55648e7f92cf9fcf78e9a6f22adacf82e6718a2a7b8faec927eb12a911d8cbf4f042d29a0ebcca1685a322741bece7365f2c7fcb
-
SSDEEP
3072:XASDiVGZgXVnV7yKbSMVhUUeBN9UYH+IPbhqFrefpFMUoh:iGWXDyKbSQ5IRPsFYMhh
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2060 set thread context of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\PCGWIN32.LI5 2484ae3c3b81170f75e6ee512c04e14a.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72} 2484ae3c3b81170f75e6ee512c04e14a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 5952677e1907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df9936f02358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 5292d7081907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df1981f62358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = e09b27b81907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086d1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df3933f52358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd 2484ae3c3b81170f75e6ee512c04e14a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2060 2484ae3c3b81170f75e6ee512c04e14a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28 PID 2060 wrote to memory of 2880 2060 2484ae3c3b81170f75e6ee512c04e14a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe"C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exeC:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe2⤵PID:2880
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD532d32badc2cd31d0aaf60665620d3ae2
SHA17436dd23742e8594a62fb6500a097bd1cc711c08
SHA256a21049f98d7786e943c21a4155f9d43f8422731b924ab7b0496e9ec8eb7f28e6
SHA512ff317663b16d17279a9116c53bad83b2ac84e236d8fcced35befe203ccd09e5f5ceb9cef8651810b501f2ba9070b0bcdd1e5e550cb614caf4218d7de2c4e3581