Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    57s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 12:36 UTC

General

  • Target

    b76a616ed9cf00389762b18798660574.exe

  • Size

    945KB

  • MD5

    b76a616ed9cf00389762b18798660574

  • SHA1

    22f98626bfaf427513f6dc9fc500637baec64544

  • SHA256

    2a514adb2304c99dc83541c167b3a3af3dc0f0e9615ed6c0726634f6bcd8280a

  • SHA512

    6f4b43d62838f01e528afc7a054e406a464fc157da00b47f3466af9d76fa21c4fb861dbece14c544c7c888ced3505e16f0f0408e3954fdd1b344bc76e2cc83ab

  • SSDEEP

    24576:l+r0o5VtMwpcxlst4C62X+EFKb51XbTk:lg0t4t4j2uiKbPnk

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 12 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b76a616ed9cf00389762b18798660574.exe
    "C:\Users\Admin\AppData\Local\Temp\b76a616ed9cf00389762b18798660574.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:508
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1188
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:544
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3692
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4352
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3504
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4476
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2308
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4100
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:756
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3320
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:4624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1632
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:2800
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1392
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:4224
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    PID:1564
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:4192
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3536
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3764
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3552
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3520
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1000
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4968
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2232
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3884
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2616
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3556
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1996
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4872
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4060
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3472
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3608
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1956
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1852
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1708
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3580
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:860
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1072
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2296
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2460
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3516
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1796
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3972
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1012
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3052
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3896
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4648
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3368
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2572
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4492
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:5100
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4288
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3560
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3216
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3068
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4092
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2084
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1184

                                                                                      Network

                                                                                      • flag-us
                                                                                        DNS
                                                                                        202.178.17.96.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        202.178.17.96.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                        202.178.17.96.in-addr.arpa
                                                                                        IN PTR
                                                                                        a96-17-178-202deploystaticakamaitechnologiescom
                                                                                      • flag-us
                                                                                        DNS
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        76.32.126.40.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        76.32.126.40.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        download4clean.com
                                                                                        b76a616ed9cf00389762b18798660574.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        download4clean.com
                                                                                        IN A
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        download4clean.com
                                                                                        b76a616ed9cf00389762b18798660574.exe
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        download4clean.com
                                                                                        IN A
                                                                                      • flag-us
                                                                                        DNS
                                                                                        g.bing.com
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        g.bing.com
                                                                                        IN A
                                                                                        Response
                                                                                        g.bing.com
                                                                                        IN CNAME
                                                                                        g-bing-com.a-0001.a-msedge.net
                                                                                        g-bing-com.a-0001.a-msedge.net
                                                                                        IN CNAME
                                                                                        dual-a-0001.a-msedge.net
                                                                                        dual-a-0001.a-msedge.net
                                                                                        IN A
                                                                                        204.79.197.200
                                                                                        dual-a-0001.a-msedge.net
                                                                                        IN A
                                                                                        13.107.21.200
                                                                                      • flag-us
                                                                                        GET
                                                                                        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=
                                                                                        Remote address:
                                                                                        204.79.197.200:443
                                                                                        Request
                                                                                        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid= HTTP/2.0
                                                                                        host: g.bing.com
                                                                                        accept-encoding: gzip, deflate
                                                                                        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                        Response
                                                                                        HTTP/2.0 204
                                                                                        cache-control: no-cache, must-revalidate
                                                                                        pragma: no-cache
                                                                                        expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                        set-cookie: MUID=21E2812E4CB56DF03F0095144D0E6CEB; domain=.bing.com; expires=Mon, 31-Mar-2025 12:37:04 GMT; path=/; SameSite=None; Secure; Priority=High;
                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                        access-control-allow-origin: *
                                                                                        x-cache: CONFIG_NOCACHE
                                                                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                        x-msedge-ref: Ref A: 6668569D1DC541DCA97DC16BA342299D Ref B: LON04EDGE0908 Ref C: 2024-03-06T12:37:04Z
                                                                                        date: Wed, 06 Mar 2024 12:37:04 GMT
                                                                                      • flag-us
                                                                                        GET
                                                                                        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=
                                                                                        Remote address:
                                                                                        204.79.197.200:443
                                                                                        Request
                                                                                        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid= HTTP/2.0
                                                                                        host: g.bing.com
                                                                                        accept-encoding: gzip, deflate
                                                                                        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                        cookie: MUID=21E2812E4CB56DF03F0095144D0E6CEB
                                                                                        Response
                                                                                        HTTP/2.0 204
                                                                                        cache-control: no-cache, must-revalidate
                                                                                        pragma: no-cache
                                                                                        expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                        set-cookie: MSPTC=1j2tErukK8SFTk8MCIW2Je51RkqcSKbyU6dHiUlHwb0; domain=.bing.com; expires=Mon, 31-Mar-2025 12:37:05 GMT; path=/; Partitioned; secure; SameSite=None
                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                        access-control-allow-origin: *
                                                                                        x-cache: CONFIG_NOCACHE
                                                                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                        x-msedge-ref: Ref A: 96E3C78206274EE7888A7BF313922363 Ref B: LON04EDGE0908 Ref C: 2024-03-06T12:37:05Z
                                                                                        date: Wed, 06 Mar 2024 12:37:04 GMT
                                                                                      • flag-us
                                                                                        GET
                                                                                        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=
                                                                                        Remote address:
                                                                                        204.79.197.200:443
                                                                                        Request
                                                                                        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid= HTTP/2.0
                                                                                        host: g.bing.com
                                                                                        accept-encoding: gzip, deflate
                                                                                        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                        cookie: MUID=21E2812E4CB56DF03F0095144D0E6CEB; MSPTC=1j2tErukK8SFTk8MCIW2Je51RkqcSKbyU6dHiUlHwb0
                                                                                        Response
                                                                                        HTTP/2.0 204
                                                                                        cache-control: no-cache, must-revalidate
                                                                                        pragma: no-cache
                                                                                        expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                        strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                        access-control-allow-origin: *
                                                                                        x-cache: CONFIG_NOCACHE
                                                                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                        x-msedge-ref: Ref A: 029BE26AFD3C46898C1F25C693E9A1C7 Ref B: LON04EDGE0908 Ref C: 2024-03-06T12:37:05Z
                                                                                        date: Wed, 06 Mar 2024 12:37:04 GMT
                                                                                      • flag-us
                                                                                        DNS
                                                                                        88.156.103.20.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        88.156.103.20.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        200.197.79.204.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        200.197.79.204.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                        200.197.79.204.in-addr.arpa
                                                                                        IN PTR
                                                                                        a-0001a-msedgenet
                                                                                      • flag-us
                                                                                        DNS
                                                                                        209.205.72.20.in-addr.arpa
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        209.205.72.20.in-addr.arpa
                                                                                        IN PTR
                                                                                        Response
                                                                                      • flag-us
                                                                                        DNS
                                                                                        soft-4download.com
                                                                                        Remote address:
                                                                                        8.8.8.8:53
                                                                                        Request
                                                                                        soft-4download.com
                                                                                        IN A
                                                                                        Response
                                                                                      • 204.79.197.200:443
                                                                                        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=
                                                                                        tls, http2
                                                                                        2.1kB
                                                                                        11.0kB
                                                                                        23
                                                                                        20

                                                                                        HTTP Request

                                                                                        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=

                                                                                        HTTP Response

                                                                                        204

                                                                                        HTTP Request

                                                                                        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=

                                                                                        HTTP Response

                                                                                        204

                                                                                        HTTP Request

                                                                                        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8c8bda9c3843499ea8c00f67932bec6d&localId=w:AE07C56D-9F7E-DB3B-D18D-2459C76F841B&deviceId=6825825924912662&anid=

                                                                                        HTTP Response

                                                                                        204
                                                                                      • 8.8.8.8:53
                                                                                        202.178.17.96.in-addr.arpa
                                                                                        dns
                                                                                        72 B
                                                                                        137 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        202.178.17.96.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        58.55.71.13.in-addr.arpa
                                                                                        dns
                                                                                        70 B
                                                                                        144 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        58.55.71.13.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        76.32.126.40.in-addr.arpa
                                                                                        dns
                                                                                        71 B
                                                                                        157 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        76.32.126.40.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        download4clean.com
                                                                                        dns
                                                                                        b76a616ed9cf00389762b18798660574.exe
                                                                                        128 B
                                                                                        137 B
                                                                                        2
                                                                                        1

                                                                                        DNS Request

                                                                                        download4clean.com

                                                                                        DNS Request

                                                                                        download4clean.com

                                                                                      • 8.8.8.8:53
                                                                                        g.bing.com
                                                                                        dns
                                                                                        56 B
                                                                                        158 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        g.bing.com

                                                                                        DNS Response

                                                                                        204.79.197.200
                                                                                        13.107.21.200

                                                                                      • 8.8.8.8:53
                                                                                        88.156.103.20.in-addr.arpa
                                                                                        dns
                                                                                        72 B
                                                                                        158 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        88.156.103.20.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        200.197.79.204.in-addr.arpa
                                                                                        dns
                                                                                        73 B
                                                                                        106 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        200.197.79.204.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        209.205.72.20.in-addr.arpa
                                                                                        dns
                                                                                        72 B
                                                                                        158 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        209.205.72.20.in-addr.arpa

                                                                                      • 8.8.8.8:53
                                                                                        soft-4download.com
                                                                                        dns
                                                                                        64 B
                                                                                        137 B
                                                                                        1
                                                                                        1

                                                                                        DNS Request

                                                                                        soft-4download.com

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\ProgramData\defender.exe

                                                                                        Filesize

                                                                                        863KB

                                                                                        MD5

                                                                                        9162e03de49e577ace655d03521082c1

                                                                                        SHA1

                                                                                        b22f0f0262bc5781743a6d815943d596ce9abc0d

                                                                                        SHA256

                                                                                        854b68869d1967f6bc0a7876f34ef109eb7fa239fb57f682ead0291ced5a0b38

                                                                                        SHA512

                                                                                        03c6c77ecd5c251b853b9c6ed35a12a12df84a72ab321cd6c707b11d42abb222b519b3a8c93f23d610710a51952d418638907ea982cd30c0f64f7af4cc25e9a5

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                        Filesize

                                                                                        471B

                                                                                        MD5

                                                                                        072f978cb84c37b419213bcc52de75f9

                                                                                        SHA1

                                                                                        e262f22d9c7534f47cba0881d2998a2c38054af3

                                                                                        SHA256

                                                                                        ced78fa743965d60321bcf823fbd357bb6214c71bc927ec9e2ae58b31373994c

                                                                                        SHA512

                                                                                        00085b74bcd14dc8f81a58d55846954f307825b9509d2b7d3aba7b614974428e3dd80c6bed016c4fcf3d959b0c4be8810abe5822f92c639f33ac93b6091706a5

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                        Filesize

                                                                                        412B

                                                                                        MD5

                                                                                        64c789b3907d9b300c4ae4fd0ef55b73

                                                                                        SHA1

                                                                                        c8aa9e2e89df41260f87b414b3e1833f098c22f7

                                                                                        SHA256

                                                                                        bd3580422c4faa3c6dd0f985a5a9a3aceebde95421ec628d292645d95e70f0bf

                                                                                        SHA512

                                                                                        966ef55c377a8eb9403c95b1183748f4c07b70d7a51108445bf4efbce00d056470089065af12fe1e856dce4f391de03f29dbb86361c18db33d337de849a7795b

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                        Filesize

                                                                                        1022B

                                                                                        MD5

                                                                                        7b5058e4550fa36515c5abb454ba8a4b

                                                                                        SHA1

                                                                                        fb6f6d9acbe9dd98af89d4f52d305fc3b951201b

                                                                                        SHA256

                                                                                        031e1533a094b24157d505d6907a1ede907247faa8d7d4b8570d111fb3c1417f

                                                                                        SHA512

                                                                                        1fc9e878a24d4f73ca058daeb7962ff211017104752846336aadcc960df36b3d0fa169485205db41a13175153f844dfdff9c27106461c431b0ea9a70e5384c51

                                                                                      • C:\Users\Public\Desktop\Malware Protection.lnk

                                                                                        Filesize

                                                                                        679B

                                                                                        MD5

                                                                                        64fd95d6af00b7a29b145e52b4f45487

                                                                                        SHA1

                                                                                        1d8ea41d3fc5c65a76c1fd9458ec0db93df819f3

                                                                                        SHA256

                                                                                        ef8f82581ecd76357892c89f724909ca3ac30c6b14762006f8e2dff792f410d1

                                                                                        SHA512

                                                                                        c2f0718a0430c242e70340b8a991df0a3e30c9cce944cc1968a71f7df2aadf00ad505af96b118bf07830e912b8a4ef60c7f480721fec08ae57f55008628fa110

                                                                                      • memory/508-32-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-49-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-16-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/508-17-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/508-18-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-20-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-21-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-22-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/508-23-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-58-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-25-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-57-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-33-0x0000000001030000-0x0000000001040000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/508-56-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-55-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-54-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-53-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-40-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-45-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-46-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-47-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/508-48-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-15-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-50-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-51-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/508-52-0x0000000000400000-0x0000000000A0F000-memory.dmp

                                                                                        Filesize

                                                                                        6.1MB

                                                                                      • memory/1812-1-0x0000000002550000-0x0000000002560000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/1812-2-0x0000000002550000-0x0000000002560000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/1812-3-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                      • memory/1812-0-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                      • memory/1812-8-0x0000000000400000-0x00000000006DE000-memory.dmp

                                                                                        Filesize

                                                                                        2.9MB

                                                                                      • memory/3692-31-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      We care about your privacy.

                                                                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.