Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2024, 04:25
Static task
static1
General
-
Target
a56c0274e6ea9bd32141634a92052d91.exe
-
Size
4.1MB
-
MD5
a56c0274e6ea9bd32141634a92052d91
-
SHA1
0f69b4fcbda90184075b84d12217abbd0c07d704
-
SHA256
4d6904b252c292f5aefe176877720e6e8520c977c9f27ba46c92e5a0b6796016
-
SHA512
c21c368a8d9e59b61ddb409958b071f206bc1c10e42b1a378a6b32b01fa4a9e107d1b840a0351a2ef3c787881e87d842ae12bd4c49050feb2dab5c7247088526
-
SSDEEP
98304:x9Y2YE0JHHIvNIDwBlb7yTglmdg7T0FHxhXU0KusqWmF6soR6R:xa22gNIDWlllsgshXDKOyso0R
Malware Config
Extracted
nullmixer
http://hsiens.xyz/
Extracted
redline
pub1
viacetequn.site:80
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub5
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/memory/3428-150-0x0000000004B30000-0x0000000004B52000-memory.dmp family_redline behavioral2/memory/3428-160-0x0000000007260000-0x0000000007280000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
resource yara_rule behavioral2/memory/3428-150-0x0000000004B30000-0x0000000004B52000-memory.dmp family_sectoprat behavioral2/memory/3428-160-0x0000000007260000-0x0000000007280000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
resource yara_rule behavioral2/memory/2072-155-0x0000000000400000-0x0000000002D0E000-memory.dmp family_vidar behavioral2/memory/2072-177-0x0000000000400000-0x0000000002D0E000-memory.dmp family_vidar behavioral2/memory/2072-180-0x0000000004830000-0x00000000048CD000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x000600000002314b-44.dat aspack_v212_v242 behavioral2/files/0x0006000000023149-43.dat aspack_v212_v242 behavioral2/files/0x0006000000023148-40.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation Fri17e57b57304ad6467.exe Key value queried \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation a56c0274e6ea9bd32141634a92052d91.exe -
Executes dropped EXE 16 IoCs
pid Process 4980 setup_install.exe 3428 Fri17523e6b49e.exe 1320 Fri17384323b14.exe 3596 Fri17e57b57304ad6467.exe 3044 Fri17bbd34709019a06.exe 224 Fri17f148864b7f11.exe 2072 Fri17c3ec4b03a0d8e6.exe 3320 Fri1743bf1fe022.exe 1916 Fri17db701d83a67.exe 4556 Fri17e57b57304ad6467.exe 5116 Fri17935370d9f965.exe 1316 Piu.exe.com 2404 Piu.exe.com 2992 Piu.exe.com 4664 Piu.exe.com 4080 Piu.exe.com -
Loads dropped DLL 6 IoCs
pid Process 4980 setup_install.exe 4980 setup_install.exe 4980 setup_install.exe 4980 setup_install.exe 4980 setup_install.exe 4980 setup_install.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Fri17384323b14.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 21 iplogger.org 22 iplogger.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 12 IoCs
pid pid_target Process procid_target 1016 4980 WerFault.exe 86 4208 2072 WerFault.exe 95 1780 2072 WerFault.exe 95 4236 2072 WerFault.exe 95 1596 2072 WerFault.exe 95 4372 2072 WerFault.exe 95 2176 2072 WerFault.exe 95 2600 2072 WerFault.exe 95 1456 2072 WerFault.exe 95 1296 2072 WerFault.exe 95 4132 2072 WerFault.exe 95 4936 2072 WerFault.exe 95 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri17935370d9f965.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri17935370d9f965.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri17935370d9f965.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1424 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3592 powershell.exe 3592 powershell.exe 3592 powershell.exe 5116 Fri17935370d9f965.exe 5116 Fri17935370d9f965.exe 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5116 Fri17935370d9f965.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 3044 Fri17bbd34709019a06.exe Token: SeDebugPrivilege 1916 Fri17db701d83a67.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 3428 Fri17523e6b49e.exe Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeCreateGlobalPrivilege 1396 dwm.exe Token: SeChangeNotifyPrivilege 1396 dwm.exe Token: 33 1396 dwm.exe Token: SeIncBasePriorityPrivilege 1396 dwm.exe Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found Token: SeShutdownPrivilege 3544 Process not Found Token: SeCreatePagefilePrivilege 3544 Process not Found -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1316 Piu.exe.com 1316 Piu.exe.com 1316 Piu.exe.com 2404 Piu.exe.com 2404 Piu.exe.com 2404 Piu.exe.com 2992 Piu.exe.com 2992 Piu.exe.com 2992 Piu.exe.com 4664 Piu.exe.com 4664 Piu.exe.com 4664 Piu.exe.com 4080 Piu.exe.com 4080 Piu.exe.com 4080 Piu.exe.com 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 1316 Piu.exe.com 1316 Piu.exe.com 1316 Piu.exe.com 2404 Piu.exe.com 2404 Piu.exe.com 2404 Piu.exe.com 2992 Piu.exe.com 2992 Piu.exe.com 2992 Piu.exe.com 4664 Piu.exe.com 4664 Piu.exe.com 4664 Piu.exe.com 4080 Piu.exe.com 4080 Piu.exe.com 4080 Piu.exe.com 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found 3544 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4980 4636 a56c0274e6ea9bd32141634a92052d91.exe 86 PID 4636 wrote to memory of 4980 4636 a56c0274e6ea9bd32141634a92052d91.exe 86 PID 4636 wrote to memory of 4980 4636 a56c0274e6ea9bd32141634a92052d91.exe 86 PID 4980 wrote to memory of 3268 4980 setup_install.exe 89 PID 4980 wrote to memory of 3268 4980 setup_install.exe 89 PID 4980 wrote to memory of 3268 4980 setup_install.exe 89 PID 4980 wrote to memory of 1548 4980 setup_install.exe 110 PID 4980 wrote to memory of 1548 4980 setup_install.exe 110 PID 4980 wrote to memory of 1548 4980 setup_install.exe 110 PID 4980 wrote to memory of 4984 4980 setup_install.exe 109 PID 4980 wrote to memory of 4984 4980 setup_install.exe 109 PID 4980 wrote to memory of 4984 4980 setup_install.exe 109 PID 4980 wrote to memory of 2500 4980 setup_install.exe 108 PID 4980 wrote to memory of 2500 4980 setup_install.exe 108 PID 4980 wrote to memory of 2500 4980 setup_install.exe 108 PID 4980 wrote to memory of 1696 4980 setup_install.exe 107 PID 4980 wrote to memory of 1696 4980 setup_install.exe 107 PID 4980 wrote to memory of 1696 4980 setup_install.exe 107 PID 4980 wrote to memory of 2340 4980 setup_install.exe 106 PID 4980 wrote to memory of 2340 4980 setup_install.exe 106 PID 4980 wrote to memory of 2340 4980 setup_install.exe 106 PID 4980 wrote to memory of 3564 4980 setup_install.exe 105 PID 4980 wrote to memory of 3564 4980 setup_install.exe 105 PID 4980 wrote to memory of 3564 4980 setup_install.exe 105 PID 4980 wrote to memory of 1536 4980 setup_install.exe 103 PID 4980 wrote to memory of 1536 4980 setup_install.exe 103 PID 4980 wrote to memory of 1536 4980 setup_install.exe 103 PID 4980 wrote to memory of 2280 4980 setup_install.exe 102 PID 4980 wrote to memory of 2280 4980 setup_install.exe 102 PID 4980 wrote to memory of 2280 4980 setup_install.exe 102 PID 4980 wrote to memory of 4524 4980 setup_install.exe 91 PID 4980 wrote to memory of 4524 4980 setup_install.exe 91 PID 4980 wrote to memory of 4524 4980 setup_install.exe 91 PID 2340 wrote to memory of 3428 2340 cmd.exe 90 PID 2340 wrote to memory of 3428 2340 cmd.exe 90 PID 2340 wrote to memory of 3428 2340 cmd.exe 90 PID 2280 wrote to memory of 1320 2280 cmd.exe 101 PID 2280 wrote to memory of 1320 2280 cmd.exe 101 PID 2280 wrote to memory of 1320 2280 cmd.exe 101 PID 1548 wrote to memory of 3596 1548 cmd.exe 98 PID 1548 wrote to memory of 3596 1548 cmd.exe 98 PID 1548 wrote to memory of 3596 1548 cmd.exe 98 PID 4524 wrote to memory of 3044 4524 cmd.exe 99 PID 4524 wrote to memory of 3044 4524 cmd.exe 99 PID 2500 wrote to memory of 224 2500 cmd.exe 96 PID 2500 wrote to memory of 224 2500 cmd.exe 96 PID 3564 wrote to memory of 3320 3564 cmd.exe 92 PID 3564 wrote to memory of 3320 3564 cmd.exe 92 PID 3564 wrote to memory of 3320 3564 cmd.exe 92 PID 3268 wrote to memory of 3592 3268 cmd.exe 93 PID 3268 wrote to memory of 3592 3268 cmd.exe 93 PID 3268 wrote to memory of 3592 3268 cmd.exe 93 PID 1696 wrote to memory of 2072 1696 cmd.exe 95 PID 1696 wrote to memory of 2072 1696 cmd.exe 95 PID 1696 wrote to memory of 2072 1696 cmd.exe 95 PID 1536 wrote to memory of 1916 1536 cmd.exe 94 PID 1536 wrote to memory of 1916 1536 cmd.exe 94 PID 1320 wrote to memory of 3476 1320 Fri17384323b14.exe 124 PID 1320 wrote to memory of 3476 1320 Fri17384323b14.exe 124 PID 1320 wrote to memory of 3476 1320 Fri17384323b14.exe 124 PID 1320 wrote to memory of 876 1320 Fri17384323b14.exe 112 PID 1320 wrote to memory of 876 1320 Fri17384323b14.exe 112 PID 1320 wrote to memory of 876 1320 Fri17384323b14.exe 112 PID 3596 wrote to memory of 4556 3596 Fri17e57b57304ad6467.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a56c0274e6ea9bd32141634a92052d91.exe"C:\Users\Admin\AppData\Local\Temp\a56c0274e6ea9bd32141634a92052d91.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17bbd34709019a06.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17bbd34709019a06.exeFri17bbd34709019a06.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17384323b14.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17db701d83a67.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1743bf1fe022.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17523e6b49e.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17c3ec4b03a0d8e6.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17f148864b7f11.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17935370d9f965.exe3⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17935370d9f965.exeFri17935370d9f965.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri17e57b57304ad6467.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 5843⤵
- Program crash
PID:1016
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17523e6b49e.exeFri17523e6b49e.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri1743bf1fe022.exeFri1743bf1fe022.exe1⤵
- Executes dropped EXE
PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17db701d83a67.exeFri17db701d83a67.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17c3ec4b03a0d8e6.exeFri17c3ec4b03a0d8e6.exe1⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 8242⤵
- Program crash
PID:4208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 8242⤵
- Program crash
PID:1780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 8242⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 8562⤵
- Program crash
PID:1596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 10082⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 10202⤵
- Program crash
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 11002⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 15442⤵
- Program crash
PID:1456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 15082⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 15842⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 17762⤵
- Program crash
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17f148864b7f11.exeFri17f148864b7f11.exe1⤵
- Executes dropped EXE
PID:224
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17e57b57304ad6467.exeFri17e57b57304ad6467.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17e57b57304ad6467.exe"C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17e57b57304ad6467.exe" -a2⤵
- Executes dropped EXE
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 49801⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\7zSC12268B7\Fri17384323b14.exeFri17384323b14.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe2⤵PID:3476
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Abbassero.wmv2⤵PID:876
-
C:\Windows\SysWOW64\cmd.execmd3⤵PID:432
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv4⤵PID:464
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comPiu.exe.com L4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4080
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping KIXJTUOD -n 304⤵
- Runs ping.exe
PID:1424
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2072 -ip 20721⤵PID:3648
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2072 -ip 20721⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2072 -ip 20721⤵PID:780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2072 -ip 20721⤵PID:1688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2072 -ip 20721⤵PID:1772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2072 -ip 20721⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2072 -ip 20721⤵PID:3108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2072 -ip 20721⤵PID:4852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2072 -ip 20721⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2072 -ip 20721⤵PID:4880
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2072 -ip 20721⤵PID:4856
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD581b3426fee30b2b8ccea75f24a45c443
SHA11d62cc858634a8a6e691e10385c2947c80ab56f9
SHA25685610cdd9ed370a632b3167f7e0944abc8c9ebd81e62d18ca14ec5ea97f5bed6
SHA512a27f9553626bb74c3ffd681c7d460708c751411733c636182b2333fc3d12e65e51b50d05f0ed2258817bae5d805d578ad697604ed7ae8efbba566305bd751073
-
Filesize
22KB
MD5492e864863ec1903f1079cfdc1466e27
SHA1f1a949020d9f75695cfa35c411a8b99f5d883357
SHA2561f83786f4775c6b100cc4c234c5c15a1075690df2fa7f78793dedeba48f4076c
SHA512f66b15a2c2e5104294b4fd789e27588e075e41d1a19f4665bbf82269e540ef2a0075fe9af992c5375890e1ecba513f7999950d9d2625a3c3563a2e42a1898c24
-
Filesize
145KB
MD58e5905ab95b99aa449ce6831cb3abe0b
SHA189b162ce7551cf0a3ec6db6c4b121baa1849d366
SHA2568258cf68f1464e659ceeff83894a4c653322b1a78ab2f9e494f6d526f6aed5b6
SHA512f3e765f8420b6089f1182c08c58cc384a5e79d6008ee1a03f5fa7d2d0906d33c899b506f566fa54c6e73e23f5868a1e44cc8cf24678bae67caade9d3081fa2e8
-
Filesize
8KB
MD5d1d4b4d26a9b9714a02c252fb46b72ce
SHA1af9e34a28f8f408853d3cd504f03ae43c03cc24f
SHA2568a77dd50b720322088fbe92aeba219cc744bd664ff660058b1949c3b9b428bac
SHA512182929a5ff0414108f74283e77ba044ab359017ace35a06f9f3ebd8b69577c22ecc85705cb908d1aa99d3a20246076bc82a7f6de7e3c4424d4e1dc3a9a6954cd
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
11KB
MD5e3915205fcffe29e70c8ebb2bbe51a18
SHA13a512607e3569740cdb3fd56c34713e0d693f04f
SHA25627fd2ac86dce366121ce11f655e7eb4e52e3a77c4edd2581b368b61a1bc9bd51
SHA5129d52ec54ebbb65f6ca52d412df9510b75ccb63cfaccd20c92c87843285da6e01e73ed15605c9163d8209960b75eb34a46c5604e908225dd83ab872200c8972b7
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
826KB
MD59764370a48918ed0fe9b57664dd4fdec
SHA19f51c2c308910003316bb19a574f8b9fb980b75c
SHA256646c938cd2a91336a10d53f4e4cd275312993f942558025003fc7cb9804d2347
SHA512813779e1f9725a10fb7301ec4582bf180be44722e8fbb79b50e482c239d78fcb90997dca5859444dc8bc5534bbd32ec26c98dd3c2478c10cd0adcb99a82de327
-
Filesize
2.1MB
MD53bb655a5b3b844c01b2367b9a453c33a
SHA1e1fd8a4b2b67a9b1c84534fecf3acc5f145d298a
SHA256f45c93ef7c7a8707c4d4f5c368524c35ce31654a83c4b78bf2c0a46940a5554c
SHA51236dbae05e23c5a57f04a181422cdba41342081e000162910321793bb5f5e1c28175b6c7d7be0d39ba13ddabd4b53a2787200f6cf69666aa805e67e465d641275
-
Filesize
1.0MB
MD5ab61d262676a3f7da7cd4be0718a9097
SHA10279ca8a174bab2cddb2a0a483507e6e1d885fff
SHA256f634ff776ec39b96d87f9cbb019e8f3af2264a561e87a634d229a5ccf9e05dd2
SHA512092cd5c101be7fe1d412057bfde5854ed58363283fa0cd313802f122744d1b68c67a666089ae29891793c43f399e39321cba635b6b1ad4ba0361e52abb203c77
-
Filesize
534B
MD5697af31c63a3d02a3e39109027671e68
SHA18a7083bc918366b05f75e54853cc39a45cc0da7c
SHA2566cb806bec68db2c4f5aee59c4f604b502a4266f020cdf408e4dc543974b88036
SHA51212a0b4f4023e04afe7515da738a4574931ff1d7538e264c93eef6142675be6bf83cdd590bbdaa6f704da9a78addd6b111a0bf23542f5c11d65b213feeaf8a8b8
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
807KB
MD592c9da284b782f1063de39cc34f0229c
SHA1856695ad18931f3d668d063ccf50ce1051cf59da
SHA2562f7fc1328c8e474e29d5981b6a485eee4e4d46690be0f75fc4778c3c5b1d2727
SHA5124b0041c1486d4ae67d934d03be15520b2d4f10146b26d253dffbd4e2787339dd52ccffe8471b7e92cfb0565a03d6aa74c680866d74546a4a15a1f11e5ace0b5f
-
Filesize
577KB
MD59d64d14627e79c6f733c74a2049c334d
SHA1771f3b69b8954df0134c5f750a92aa521a2d9a36
SHA2560d16e628415ab84ab9d56af4587fe1419acdb5806b7d9dda552a5bf66a5b56c6
SHA512433da42bd563ff43e5e4ce399b9bab8bb64a62fc67aea8114b49b4a1e8e4b0bdba68ade2e70b5a62cb4417e06200e2dfb5fe8bb6ca9141947148d22af09223db
-
Filesize
404KB
MD5ffc60896f3d9abe24f98b339fffcf572
SHA122d44cf81b7130aea498ae823087e2f332a696d6
SHA256db18c8155653dfbe8338e06a8a0c86c2f65c38b299ea87f5a42dd76ce9cfa311
SHA5121afbfe6034326d8d0c2ab61243162738145f9d8511327660786e3e8a06aae6148af038cd4af89f786c3a3e6ed9495c6b4738e3ffc9f9c1cab641e27354f197b2
-
Filesize
872KB
MD548c3a0e572e8b258f5d9f4891278ea7a
SHA1db742db08c27bd7f74977d53ba532a5fae6e3cad
SHA256ed7cf7296658bc2aae125c803ce7e6242397f7ed783f8852708d2c558fc6e75e
SHA512615542411ff6fbec3ac03573ab6b975a10056b51541503ac9ee8f683b9f4875d7f5f00ed8c19a07d25b5daea0ef39fe7ef45414b1e6dc7d5d45147172c33f672
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
64KB
MD556946c483df09f2579446d14e08f86ac
SHA1478f9df541717d9284b62755ee4a24448c9a5be9
SHA2569ba7b4f2c2ee7c8da4e606a64770c5dd7e1b504042bc7465440f786d27b207f9
SHA5128facd4fa0cb97568737cbac69c2e352be5d7d370c52aac2454fabb32fcbc434972538e4987ce45861e1ba9285a0214a390a17ef40e499c7b197c36b3b63e7027