Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 05:07

General

  • Target

    4fa98a44f4c4edbf0631c8d90e9287e8.exe

  • Size

    56KB

  • MD5

    4fa98a44f4c4edbf0631c8d90e9287e8

  • SHA1

    cfa0833c274e01b097c4a4a0e644daa96d761164

  • SHA256

    862720660bdab28c9473c00a3c064f6ad0b4124dc8d02064422cf970281f13e2

  • SHA512

    a4bf469a330d3486f0d808c7ddd9af6ea2c23c585b8a3030d58b03f1ee481c5cb6863bd32db7fb72cfe03db1af797d3e0b3a4239d37efa209bd4df7d65cc51fc

  • SSDEEP

    768:uEaz5G7MaEtbwQpeyjaSLyfOPT4xcsrRA9Xu/IC4X3i2AH350azknSRXJuRWQlhL:v4GYUWeypTUuuQj635cSRU3iN/ntN6

Score
7/10

Malware Config

Signatures

  • Drops startup file 45 IoCs
  • Executes dropped EXE 45 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 45 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe
    "C:\Users\Admin\AppData\Local\Temp\4fa98a44f4c4edbf0631c8d90e9287e8.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4080
    • \??\c:\windows\SysWOW64\dwdsrngt.exe
      c:\windows\system32\dwdsrngt.exe CHD001
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1088
      • \??\c:\windows\SysWOW64\dwdsrngt.exe
        c:\windows\system32\dwdsrngt.exe CHD001
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1128
        • \??\c:\windows\SysWOW64\dwdsrngt.exe
          c:\windows\system32\dwdsrngt.exe CHD001
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:552
          • \??\c:\windows\SysWOW64\dwdsrngt.exe
            c:\windows\system32\dwdsrngt.exe CHD001
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4208
            • \??\c:\windows\SysWOW64\dwdsrngt.exe
              c:\windows\system32\dwdsrngt.exe CHD001
              6⤵
              • Drops startup file
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3940
              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                c:\windows\system32\dwdsrngt.exe CHD001
                7⤵
                • Drops startup file
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1492
                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                  c:\windows\system32\dwdsrngt.exe CHD001
                  8⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2932
                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                    c:\windows\system32\dwdsrngt.exe CHD001
                    9⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3908
                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                      c:\windows\system32\dwdsrngt.exe CHD001
                      10⤵
                        PID:1948
                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                          c:\windows\system32\dwdsrngt.exe CHD001
                          11⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2684
                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                            c:\windows\system32\dwdsrngt.exe CHD001
                            12⤵
                            • Drops startup file
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:4156
                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                              c:\windows\system32\dwdsrngt.exe CHD001
                              13⤵
                              • Drops startup file
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:820
                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                c:\windows\system32\dwdsrngt.exe CHD001
                                14⤵
                                • Drops startup file
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4464
                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                  c:\windows\system32\dwdsrngt.exe CHD001
                                  15⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:684
                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                    c:\windows\system32\dwdsrngt.exe CHD001
                                    16⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4588
                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                      c:\windows\system32\dwdsrngt.exe CHD001
                                      17⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:928
                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                        c:\windows\system32\dwdsrngt.exe CHD001
                                        18⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1044
                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                          c:\windows\system32\dwdsrngt.exe CHD001
                                          19⤵
                                          • Drops startup file
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:2904
                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                            c:\windows\system32\dwdsrngt.exe CHD001
                                            20⤵
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4188
                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                              c:\windows\system32\dwdsrngt.exe CHD001
                                              21⤵
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:4088
                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                22⤵
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:1224
                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                  23⤵
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2816
                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                    24⤵
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3172
                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                      25⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2024
                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                        26⤵
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2916
                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                          27⤵
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1948
                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                            28⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2148
                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                              29⤵
                                                              • Drops startup file
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1772
                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                30⤵
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3636
                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                  31⤵
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1244
                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                    32⤵
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1680
                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                      33⤵
                                                                      • Drops startup file
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • Modifies registry class
                                                                      PID:4780
                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                        34⤵
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        PID:1012
                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                          35⤵
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • Modifies registry class
                                                                          PID:4856
                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                            36⤵
                                                                            • Drops startup file
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Modifies registry class
                                                                            PID:3080
                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                              37⤵
                                                                              • Drops startup file
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Modifies registry class
                                                                              PID:4228
                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                38⤵
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Modifies registry class
                                                                                PID:4308
                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                  39⤵
                                                                                  • Drops startup file
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies registry class
                                                                                  PID:4836
                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                    40⤵
                                                                                    • Drops startup file
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • Modifies registry class
                                                                                    PID:1044
                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                      41⤵
                                                                                      • Drops startup file
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      PID:2904
                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                        42⤵
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies registry class
                                                                                        PID:408
                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                          43⤵
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies registry class
                                                                                          PID:1300
                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                            44⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Modifies registry class
                                                                                            PID:4500
                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                              45⤵
                                                                                              • Drops startup file
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • Modifies registry class
                                                                                              PID:3636
                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                46⤵
                                                                                                  PID:852
                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                    47⤵
                                                                                                      PID:4836
                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                        48⤵
                                                                                                          PID:1044
                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                            49⤵
                                                                                                              PID:4428
                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                50⤵
                                                                                                                  PID:3940
                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                    51⤵
                                                                                                                      PID:4028
                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                        52⤵
                                                                                                                          PID:4836
                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                            53⤵
                                                                                                                              PID:1280
                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                54⤵
                                                                                                                                  PID:4456
                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                    55⤵
                                                                                                                                      PID:376
                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                        56⤵
                                                                                                                                          PID:1200
                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                            57⤵
                                                                                                                                              PID:3348
                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                58⤵
                                                                                                                                                  PID:840
                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                    59⤵
                                                                                                                                                      PID:4324
                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                        60⤵
                                                                                                                                                          PID:1332
                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                            61⤵
                                                                                                                                                              PID:4484
                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                62⤵
                                                                                                                                                                  PID:4736
                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                    63⤵
                                                                                                                                                                      PID:3268
                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                        64⤵
                                                                                                                                                                          PID:100
                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                            65⤵
                                                                                                                                                                              PID:4136
                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                66⤵
                                                                                                                                                                                  PID:4056
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                    67⤵
                                                                                                                                                                                      PID:5092
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                        68⤵
                                                                                                                                                                                          PID:2904
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                            69⤵
                                                                                                                                                                                              PID:4900
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                70⤵
                                                                                                                                                                                                  PID:752
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                          PID:4352
                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:2040
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:852
                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                    PID:3936
                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                PID:376
                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                    PID:224
                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                            PID:3348
                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                PID:1240
                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                PID:1380
                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                    PID:3776
                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                        PID:3800
                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2588
                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:904
                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:920
                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:100
                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHD001
                                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3372

                                                                                                                                                                            Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk

                                                                                                                                                                              Filesize

                                                                                                                                                                              989B

                                                                                                                                                                              MD5

                                                                                                                                                                              8ad9fc8c24440e0e2fb52141b7af8c1b

                                                                                                                                                                              SHA1

                                                                                                                                                                              c830ca282c95452e95a4d40804d1fae2672217e7

                                                                                                                                                                              SHA256

                                                                                                                                                                              061d1701f30e00bc516df0e7ad519becfafc09000c4d61ef133392983dfc29f1

                                                                                                                                                                              SHA512

                                                                                                                                                                              37346049a95e0a06624141d47cbe16454c49d960233288b792e5d31e5882eaa2bc01cd265af5e180034f59ebc61b600236bf52e919f2ae08dab0e365b2d922b3

                                                                                                                                                                            • C:\Windows\SysWOW64\msnav32.ax

                                                                                                                                                                              Filesize

                                                                                                                                                                              17B

                                                                                                                                                                              MD5

                                                                                                                                                                              b9b738b5d5b92889336547a6c22d3991

                                                                                                                                                                              SHA1

                                                                                                                                                                              55e7ec0184ac63a182d8973d68a7294d493b75e4

                                                                                                                                                                              SHA256

                                                                                                                                                                              c327e7bb193088f8afc07ff624422abc3cf7f06bed33b62ba08b443bf306d69f

                                                                                                                                                                              SHA512

                                                                                                                                                                              5a2879f1aeb783e1b1895cc7a7fc3f752c6a6173581f71062c0c145bf78e560de848294111a1f1ae79e92e96e604ec455af0e69d073a74e9827dcd0fd5489af7

                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe

                                                                                                                                                                              Filesize

                                                                                                                                                                              56KB

                                                                                                                                                                              MD5

                                                                                                                                                                              8ee5f405462abf2f678265bb0b6155e8

                                                                                                                                                                              SHA1

                                                                                                                                                                              bd248e52d4c330db55dd22cfc74c5dc76d8437b9

                                                                                                                                                                              SHA256

                                                                                                                                                                              20ea1c0b436861a7dca075b5215072cd1b1b83cd42ad38d26f50953b0de4b1b0

                                                                                                                                                                              SHA512

                                                                                                                                                                              e8fdec1b917ba2fe7c6ba3a896c9859acf3aece5f8325216fa4614b89f1cc996af9ab30d0b382f861bf1c3700648977fd2c7e99430eefc25a38e81d016223621