Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
579s -
platform
windows7_x64 -
resource
win7-20231215-es -
resource tags
arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows -
submitted
24/01/2024, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
WannaCrypt0r.zip
Resource
win7-20231215-es
General
-
Target
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
Malware Config
Extracted
C:\Users\Admin\Documents\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD7056.tmp [email protected] -
Executes dropped EXE 61 IoCs
pid Process 2580 taskdl.exe 2180 @[email protected] 1996 @[email protected] 1804 taskhsvc.exe 1364 taskdl.exe 1332 taskse.exe 2952 @[email protected] 1704 taskdl.exe 1640 taskse.exe 1564 @[email protected] 2996 taskdl.exe 528 taskse.exe 500 @[email protected] 3008 taskdl.exe 1116 taskse.exe 2572 @[email protected] 2296 taskdl.exe 2144 taskse.exe 1004 @[email protected] 2064 taskdl.exe 1620 taskse.exe 2884 @[email protected] 1656 taskse.exe 968 @[email protected] 1532 taskdl.exe 1508 taskse.exe 2188 @[email protected] 2340 taskdl.exe 2204 taskse.exe 2644 @[email protected] 2748 taskdl.exe 2816 taskse.exe 2736 @[email protected] 2772 taskdl.exe 480 taskse.exe 2536 @[email protected] 528 taskdl.exe 2988 taskse.exe 3032 @[email protected] 2508 taskdl.exe 2024 taskse.exe 2448 @[email protected] 2304 taskdl.exe 1572 taskse.exe 1904 @[email protected] 1540 taskdl.exe 2712 taskse.exe 2168 @[email protected] 3016 taskdl.exe 1548 taskse.exe 284 @[email protected] 2252 taskdl.exe 2044 taskse.exe 2472 @[email protected] 1276 taskdl.exe 1600 taskse.exe 2096 @[email protected] 1696 taskdl.exe 2248 taskse.exe 836 @[email protected] 268 taskdl.exe -
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2692 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bvjwcamt067 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2364 vssadmin.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1816 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1804 taskhsvc.exe 1804 taskhsvc.exe 1804 taskhsvc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2952 @[email protected] -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1972 vssvc.exe Token: SeRestorePrivilege 1972 vssvc.exe Token: SeAuditPrivilege 1972 vssvc.exe Token: SeIncreaseQuotaPrivilege 2848 WMIC.exe Token: SeSecurityPrivilege 2848 WMIC.exe Token: SeTakeOwnershipPrivilege 2848 WMIC.exe Token: SeLoadDriverPrivilege 2848 WMIC.exe Token: SeSystemProfilePrivilege 2848 WMIC.exe Token: SeSystemtimePrivilege 2848 WMIC.exe Token: SeProfSingleProcessPrivilege 2848 WMIC.exe Token: SeIncBasePriorityPrivilege 2848 WMIC.exe Token: SeCreatePagefilePrivilege 2848 WMIC.exe Token: SeBackupPrivilege 2848 WMIC.exe Token: SeRestorePrivilege 2848 WMIC.exe Token: SeShutdownPrivilege 2848 WMIC.exe Token: SeDebugPrivilege 2848 WMIC.exe Token: SeSystemEnvironmentPrivilege 2848 WMIC.exe Token: SeRemoteShutdownPrivilege 2848 WMIC.exe Token: SeUndockPrivilege 2848 WMIC.exe Token: SeManageVolumePrivilege 2848 WMIC.exe Token: 33 2848 WMIC.exe Token: 34 2848 WMIC.exe Token: 35 2848 WMIC.exe Token: SeIncreaseQuotaPrivilege 2848 WMIC.exe Token: SeSecurityPrivilege 2848 WMIC.exe Token: SeTakeOwnershipPrivilege 2848 WMIC.exe Token: SeLoadDriverPrivilege 2848 WMIC.exe Token: SeSystemProfilePrivilege 2848 WMIC.exe Token: SeSystemtimePrivilege 2848 WMIC.exe Token: SeProfSingleProcessPrivilege 2848 WMIC.exe Token: SeIncBasePriorityPrivilege 2848 WMIC.exe Token: SeCreatePagefilePrivilege 2848 WMIC.exe Token: SeBackupPrivilege 2848 WMIC.exe Token: SeRestorePrivilege 2848 WMIC.exe Token: SeShutdownPrivilege 2848 WMIC.exe Token: SeDebugPrivilege 2848 WMIC.exe Token: SeSystemEnvironmentPrivilege 2848 WMIC.exe Token: SeRemoteShutdownPrivilege 2848 WMIC.exe Token: SeUndockPrivilege 2848 WMIC.exe Token: SeManageVolumePrivilege 2848 WMIC.exe Token: 33 2848 WMIC.exe Token: 34 2848 WMIC.exe Token: 35 2848 WMIC.exe Token: SeTcbPrivilege 1332 taskse.exe Token: SeTcbPrivilege 1332 taskse.exe Token: SeTcbPrivilege 1640 taskse.exe Token: SeTcbPrivilege 1640 taskse.exe Token: SeTcbPrivilege 528 taskse.exe Token: SeTcbPrivilege 528 taskse.exe Token: SeTcbPrivilege 1116 taskse.exe Token: SeTcbPrivilege 1116 taskse.exe Token: SeTcbPrivilege 2144 taskse.exe Token: SeTcbPrivilege 2144 taskse.exe Token: SeTcbPrivilege 1620 taskse.exe Token: SeTcbPrivilege 1620 taskse.exe Token: SeTcbPrivilege 1656 taskse.exe Token: SeTcbPrivilege 1656 taskse.exe Token: SeTcbPrivilege 1508 taskse.exe Token: SeTcbPrivilege 1508 taskse.exe Token: SeTcbPrivilege 2204 taskse.exe Token: SeTcbPrivilege 2204 taskse.exe Token: SeTcbPrivilege 2816 taskse.exe Token: SeTcbPrivilege 2816 taskse.exe Token: SeTcbPrivilege 480 taskse.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2180 @[email protected] 1996 @[email protected] 1996 @[email protected] 2180 @[email protected] 2952 @[email protected] 2952 @[email protected] 1564 @[email protected] 500 @[email protected] 2572 @[email protected] 1004 @[email protected] 2884 @[email protected] 968 @[email protected] 2188 @[email protected] 2644 @[email protected] 2736 @[email protected] 2536 @[email protected] 3032 @[email protected] 2448 @[email protected] 1904 @[email protected] 2168 @[email protected] 284 @[email protected] 2472 @[email protected] 2096 @[email protected] 836 @[email protected] -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2732 1876 [email protected] 28 PID 1876 wrote to memory of 2732 1876 [email protected] 28 PID 1876 wrote to memory of 2732 1876 [email protected] 28 PID 1876 wrote to memory of 2732 1876 [email protected] 28 PID 1876 wrote to memory of 2692 1876 [email protected] 29 PID 1876 wrote to memory of 2692 1876 [email protected] 29 PID 1876 wrote to memory of 2692 1876 [email protected] 29 PID 1876 wrote to memory of 2692 1876 [email protected] 29 PID 1876 wrote to memory of 2580 1876 [email protected] 32 PID 1876 wrote to memory of 2580 1876 [email protected] 32 PID 1876 wrote to memory of 2580 1876 [email protected] 32 PID 1876 wrote to memory of 2580 1876 [email protected] 32 PID 1876 wrote to memory of 2276 1876 [email protected] 33 PID 1876 wrote to memory of 2276 1876 [email protected] 33 PID 1876 wrote to memory of 2276 1876 [email protected] 33 PID 1876 wrote to memory of 2276 1876 [email protected] 33 PID 2276 wrote to memory of 1480 2276 cmd.exe 35 PID 2276 wrote to memory of 1480 2276 cmd.exe 35 PID 2276 wrote to memory of 1480 2276 cmd.exe 35 PID 2276 wrote to memory of 1480 2276 cmd.exe 35 PID 1876 wrote to memory of 1504 1876 [email protected] 36 PID 1876 wrote to memory of 1504 1876 [email protected] 36 PID 1876 wrote to memory of 1504 1876 [email protected] 36 PID 1876 wrote to memory of 1504 1876 [email protected] 36 PID 1876 wrote to memory of 2180 1876 [email protected] 39 PID 1876 wrote to memory of 2180 1876 [email protected] 39 PID 1876 wrote to memory of 2180 1876 [email protected] 39 PID 1876 wrote to memory of 2180 1876 [email protected] 39 PID 1876 wrote to memory of 1372 1876 [email protected] 40 PID 1876 wrote to memory of 1372 1876 [email protected] 40 PID 1876 wrote to memory of 1372 1876 [email protected] 40 PID 1876 wrote to memory of 1372 1876 [email protected] 40 PID 1372 wrote to memory of 1996 1372 cmd.exe 42 PID 1372 wrote to memory of 1996 1372 cmd.exe 42 PID 1372 wrote to memory of 1996 1372 cmd.exe 42 PID 1372 wrote to memory of 1996 1372 cmd.exe 42 PID 2180 wrote to memory of 1804 2180 @[email protected] 44 PID 2180 wrote to memory of 1804 2180 @[email protected] 44 PID 2180 wrote to memory of 1804 2180 @[email protected] 44 PID 2180 wrote to memory of 1804 2180 @[email protected] 44 PID 1996 wrote to memory of 2632 1996 @[email protected] 46 PID 1996 wrote to memory of 2632 1996 @[email protected] 46 PID 1996 wrote to memory of 2632 1996 @[email protected] 46 PID 1996 wrote to memory of 2632 1996 @[email protected] 46 PID 2632 wrote to memory of 2364 2632 cmd.exe 48 PID 2632 wrote to memory of 2364 2632 cmd.exe 48 PID 2632 wrote to memory of 2364 2632 cmd.exe 48 PID 2632 wrote to memory of 2364 2632 cmd.exe 48 PID 2632 wrote to memory of 2848 2632 cmd.exe 50 PID 2632 wrote to memory of 2848 2632 cmd.exe 50 PID 2632 wrote to memory of 2848 2632 cmd.exe 50 PID 2632 wrote to memory of 2848 2632 cmd.exe 50 PID 1876 wrote to memory of 1364 1876 [email protected] 52 PID 1876 wrote to memory of 1364 1876 [email protected] 52 PID 1876 wrote to memory of 1364 1876 [email protected] 52 PID 1876 wrote to memory of 1364 1876 [email protected] 52 PID 1876 wrote to memory of 1332 1876 [email protected] 53 PID 1876 wrote to memory of 1332 1876 [email protected] 53 PID 1876 wrote to memory of 1332 1876 [email protected] 53 PID 1876 wrote to memory of 1332 1876 [email protected] 53 PID 1876 wrote to memory of 2952 1876 [email protected] 54 PID 1876 wrote to memory of 2952 1876 [email protected] 54 PID 1876 wrote to memory of 2952 1876 [email protected] 54 PID 1876 wrote to memory of 2952 1876 [email protected] 54 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2732 attrib.exe 1504 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:2732
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2580
-
-
C:\Windows\SysWOW64\cmd.execmd /c 304891706113222.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- Loads dropped DLL
PID:1480
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @[email protected] vs2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2364
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bvjwcamt067" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵PID:2376
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "bvjwcamt067" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:1816
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:500
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2572
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:968
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:480
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:528
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:284
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:268
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136B
MD586f4b793f293ede1b78ab3967c21634c
SHA17b06caf452a8ebc840c212d5bcc9e44f48d0e7c0
SHA256c36dc3cf7c57ec286d31cd2fdc2779b4bc9653b51436ea19510f29481fc1af66
SHA512cf2a67993d3718573e5e851c46c584adefc329833eac5d158d7a666f64a9008030caceb639fb28a3b182a30f84dec9fe5fe15edc13186b9dc49757227ebd2933
-
Filesize
447KB
MD5f7f1b7150f55d679bbca5b41df7ffea7
SHA1830f46bb477f41c226370e356f6f0940dc340b7b
SHA256109cde1f41072d052bc45c005cb064e4143ebb9b6d85dfadb3d50976bf6fe2e8
SHA51212c9a075fabfc3bb76158d3e2df1230c6401715df0f5768eb6363bd74325b5334580ddc6a5c93516e9463874844449854bd00cb759cf005889bec27cd95cc692
-
Filesize
698KB
MD55155fb9bbfba1893b99c0ee203efa6a7
SHA153c2e3a8145f9701f5bb1361ce32214d9acb97ba
SHA256186fd2e80adb19a0bc392d6bf6a62bed1cb8c3584a3c1d7aa685096f0b43defa
SHA51258a25af6295fdc57f6d0ca1ad20c220890ccc6483aa976a92d96814731b8a1850531b2e71df6071fe44a89dff330234184825d47c19a308f8a518abd70fdee37
-
Filesize
11KB
MD51e9b9777d83c5f043f0247e834823a54
SHA120b06aa5c1e116d323fd14e7481ac99afb6c76bd
SHA256aac8637adad7a2d2046a16812dfdd36c7361d1c9433d257f8d98604be24629c5
SHA5128ea7ebe357148ec0418b5f26726d29e9cd75aa15f5a61777e36c7addc99ef303165b76533ab8d3cfb14a3a7beee85d7fc7dfa0189a081988c457e4ff5920e69a
-
Filesize
11KB
MD5e571d5b48cbfe3e6613c82c12709b8f9
SHA1d46eaaa3523929d13adc7d8cf957bb2e657c1c3c
SHA25606bdc167d927a97e1bb2d2252775def31583c9b09b1885f92bf09c1ac7d336fb
SHA512e70868248ea3d2d371be025b2092aeba63f228c5bdbec781b9b235b7c0a0b9002e1f15cdfda34e84e5a6ff68d88dd3793c306230b460bcaa040ee5451d23738d
-
Filesize
832KB
MD50a3021b35dd0ea9dbc64ccc8d60ebca8
SHA1cad367a44a088cfc8635da9bef0f6cf7c7f38b30
SHA25633a1a59ecc7c30f789ba7d43b4b33519562cbb97f729b93bfbc5784e95f98263
SHA512462ca66da96aff11867c62628c3b7ef6690aa0743be56a50355b7077f1ddd076aa2d9b613dcaf3d5f0641344563f89c59347fb1c9a2faec5e20213ac058f9f72
-
Filesize
11KB
MD551ec5d722717c7ce5b342d0cbf3605e7
SHA1f279cc59402d114a9dfa7f44ce9ec0967a19ea79
SHA2562e5ebff63fd7b659e9f3ba179512aaa462c34b4bb8dd49d0bb763c65cfea786b
SHA512260293cda09bb82c7e0c420e7b4e6b300e403ea52672eba53c3332abd3582dc6b5731c718756c9d71386ec35a63d2ee5b88967bec4b6b2ff90b96441f31d0b5a
-
Filesize
340B
MD53867f2ec82a7d77c9ffefb1aac8b7903
SHA106fccf19b9c498b5afa2b35da00e3ab28d56f785
SHA2564e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
SHA512b413994e5b9f0ecb956055c7befff14845b56bb658fd8280d3213fdfa175ff76bc56e082174f2475fdf2d1f9eff618ebfd80ee2b67c091eaf1fd9c94697da5aa
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Filesize916B
MD5432e6fc5ab2fbc80dfcc24a34449c23a
SHA11e24bf054144b4c26851f159fd5e229438b0576e
SHA256466e250281f8d9bac4bf20fd310b0f78d03fa4a34256208796ac53b98451b3ec
SHA5120c0bdb7fd7a12b77845338a29ac9494adb10cbe84624cbfc75f97fba877d95119b6fdf28f1598f899909efe48897c22f0e7c6b28b51c7ed7c7b58ecbac12e15b
-
Filesize
1.1MB
MD5df46ef992948c626feaf91820629341d
SHA1195ce5701799f6da24e7b2d30962ed2f75bbe0f8
SHA256f0a650b9262a55151eefa6af9059bbf92a379132fcac1d83d1994aa4dcd54659
SHA512ad7b9f9cabcf6cdf7664832d766dd20449d9bef759fa0fab8d4da054b763627c131cc8ac1111c2d33224e240d039f4691c9ae4c0f6dfa48bb4d7ea405964ba3f
-
Filesize
694KB
MD5a12c2040f6fddd34e7acb42f18dd6bdc
SHA1d7db49f1a9870a4f52e1f31812938fdea89e9444
SHA256bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
SHA512fbe0970bcdfaa23af624daad9917a030d8f0b10d38d3e9c7808a9fbc02912ee9daed293dbdea87aa90dc74470bc9b89cb6f2fe002393ecda7b565307ffb7ec00
-
Filesize
702KB
MD590f50a285efa5dd9c7fddce786bdef25
SHA154213da21542e11d656bb65db724105afe8be688
SHA25677a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
SHA512746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae
-
Filesize
510KB
MD573d4823075762ee2837950726baa2af9
SHA1ebce3532ed94ad1df43696632ab8cf8da8b9e221
SHA2569aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
SHA5128f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5
-
Filesize
911KB
MD5ec02690960b9de0c54b8a4b119baa819
SHA19a231d171cc851f9615724cb8b6d88265b6f2b9b
SHA256591daa23fe52c7286bc1ba9aa969e2e00b514129fa81e43b9bf108fde52b81cf
SHA51236fcc40b129f286d315768075b26d688f64ec96066859c594adab00dc2c0b7175f03e1e4625c3dc338e72005760fb51dc1bfea8faf3bd3300ff089c475b36013
-
Filesize
1.3MB
MD53812587643b0576ab95f6d407c538bd8
SHA11ce0c921f64becfcb84fd977ec268f54e7cf5108
SHA2566c45f5c0def604d2d9698a1996b1dd9cf0664f5f35f4bee0c4bf1821d759bdba
SHA512095d85e12ba86a257da5c492007bc0c38c08b2bddbf88861bf5637a0ab3d3a4a89e913083077c0affb87553769b91be7c1ad464960f509df08851f9c052da3b1
-
Filesize
105KB
MD5fb072e9f69afdb57179f59b512f828a4
SHA1fe71b70173e46ee4e3796db9139f77dc32d2f846
SHA25666d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
SHA5129d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8
-
Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
780B
MD58124a611153cd3aceb85a7ac58eaa25d
SHA1c1d5cd8774261d810dca9b6a8e478d01cd4995d6
SHA2560ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
SHA512b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17
-
Filesize
780B
MD521dd17a7da66e6f1fb5975399e261c70
SHA110f72924f11428ac3d79c27a1408212999aee0dc
SHA25662ea47ce00f736fbab7701ccf03d42add99f169ee536718f59659159f91b4837
SHA5127fa9c111a186a24ccebc1c948226a95f99b497b09a0e95b4b8cf6cc1e8bf5c8dae8046bd470c2d97d1c5aad756f626d4e86dcc58751ecb93ab6cbbe99ec4facc
-
Filesize
219B
MD582a1fc4089755cb0b5a498ffdd52f20f
SHA10a8c0da8ef0354f37241e2901cf82ec9ce6474aa
SHA2567fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
SHA5121573a0c7333accef2695efefe1b57cba8f8d66a0061c24420ee0a183343a9a319995267d306ee85084c95580f9855bcdf9dee559b28a200b27fc3cc353315e78
-
Filesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
Filesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
2.4MB
MD529fde18dc57c7c6097ecdd6dc8ec3a75
SHA19813a6fe55ea00aa9f3e37b12f2fe4fdacf23313
SHA256d31ff1691c839133ca6bec1f41b7a1e7e390919324be6ee2ad84bdd08fcb89d7
SHA5121da3714804378c54b9eea677bca5d9f45721ed1db82b48d49d9f98a624214b598bd331f218c1e326980ecbec14da5cf67d0059e261fd0fd20cd2b63e3db40753
-
Filesize
3.8MB
MD5e0bedb52e47d1510512a2d9b5d562221
SHA12fd0e6e55314504c3cb0efe82fb8f73cb87d8f56
SHA256da4df309ed33fd7b0e865a55bab5a03d53cd08f70f2bffdf6690b506afac645f
SHA51230bac929694bf580b8ccfeb87e771089d980000822ba96683436910ef38317e0719e120e42e5c9268b1fc5949df8d046796be2432fe7219fe354b7f750192dff
-
C:\Users\Admin\Documents\@[email protected]
Filesize933B
MD57a2726bb6e6a79fb1d092b7f2b688af0
SHA1b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA5124e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54
-
Filesize
768KB
MD5862d4a89b85c04eaae6b5afd738190f6
SHA1f57b6678645818284304bf2f726ed81b4f549e9b
SHA2566405b195a59c32bc6aea88a2985379d49d53909f4c2600e1a15a4b1383bd1ba6
SHA512fd32e1830b6e7348401e353f87064cb468aeac7571602cd3655b3c5b36ce238a8f91c85e6d40ccb94d718eefa8c933111038eca5c8a26bf9c425ed0636236107
-
Filesize
90KB
MD578581e243e2b41b17452da8d0b5b2a48
SHA1eaefb59c31cf07e60a98af48c5348759586a61bb
SHA256f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
SHA512332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a
-
Filesize
1.9MB
MD5581a834074e2e95ab81d77130de0e35c
SHA16acd227e3ef90181d41ec23aa4bcf549cb9e6466
SHA2564b6bed61360999af1d111d31bb5df3facc62661578b2bf93fa67159b4d758578
SHA51267ce85159ff16ca8df3c715b9b227f4571aa90e19f525d162426cd362372818aed731ed7cc734f349e0dca281a9e07aff3159aece3f5714ce652c4518a352055
-
Filesize
1.2MB
MD5a693d3740a7795f5630aee09c2b3e86e
SHA17a840845c720fb170d1c7bff9a7e5d41ed3cac9a
SHA256a69477c1dc33960bd21998c2b74f0f6a6897de2ca8fab3ee7a6a2c2bb9a27d2c
SHA5129a1b721c6103a02e0c79c9eeaf2fb775c4c28644e9bf6efd179fb8d34e91b4611d5bf3bca169c5878149a10bcc2a1592bd8b5ea60071206bf615cd3fac3a9cf5
-
Filesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
Filesize
20KB
MD58495400f199ac77853c53b5a3f278f3e
SHA1be5d6279874da315e3080b06083757aad9b32c23
SHA2562ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA5120669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4