Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20240215-es -
resource tags
arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows -
submitted
08/03/2024, 22:11
Behavioral task
behavioral1
Sample
DFIR.exe
Resource
win7-20240215-es
General
-
Target
DFIR.exe
-
Size
2.8MB
-
MD5
e372d1ba2d3a1936e3e8cdd3febf2038
-
SHA1
06ed6e0be895945bc78adac9aa0283e50fc93349
-
SHA256
137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9
-
SHA512
058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70
-
SSDEEP
49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR
Malware Config
Signatures
-
Contacts a large (20060) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/files/0x0008000000015fa7-14.dat xmrig behavioral1/memory/2160-269-0x0000000000400000-0x000000000152F000-memory.dmp xmrig behavioral1/memory/2160-368-0x0000000000400000-0x000000000152F000-memory.dmp xmrig behavioral1/memory/2160-567-0x0000000000400000-0x000000000152F000-memory.dmp xmrig behavioral1/memory/2160-699-0x0000000000400000-0x000000000152F000-memory.dmp xmrig behavioral1/memory/2160-706-0x0000000000400000-0x000000000152F000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
pid Process 2160 DFIR.exe 2160 DFIR.exe -
resource yara_rule behavioral1/memory/2160-0-0x0000000000400000-0x000000000152F000-memory.dmp upx behavioral1/memory/2160-269-0x0000000000400000-0x000000000152F000-memory.dmp upx behavioral1/memory/2160-368-0x0000000000400000-0x000000000152F000-memory.dmp upx behavioral1/memory/2160-567-0x0000000000400000-0x000000000152F000-memory.dmp upx behavioral1/memory/2160-699-0x0000000000400000-0x000000000152F000-memory.dmp upx behavioral1/memory/2160-706-0x0000000000400000-0x000000000152F000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2576 sc.exe 2624 sc.exe 2524 sc.exe 2712 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2616 NETSTAT.EXE -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe 2160 DFIR.exe -
Suspicious behavior: LoadsDriver 14 IoCs
pid Process 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found 436 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2616 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1600 AcroRd32.exe 1600 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2480 2160 DFIR.exe 29 PID 2160 wrote to memory of 2480 2160 DFIR.exe 29 PID 2160 wrote to memory of 2480 2160 DFIR.exe 29 PID 2480 wrote to memory of 2712 2480 cmd.exe 30 PID 2480 wrote to memory of 2712 2480 cmd.exe 30 PID 2480 wrote to memory of 2712 2480 cmd.exe 30 PID 2160 wrote to memory of 2500 2160 DFIR.exe 31 PID 2160 wrote to memory of 2500 2160 DFIR.exe 31 PID 2160 wrote to memory of 2500 2160 DFIR.exe 31 PID 2500 wrote to memory of 2576 2500 cmd.exe 32 PID 2500 wrote to memory of 2576 2500 cmd.exe 32 PID 2500 wrote to memory of 2576 2500 cmd.exe 32 PID 2160 wrote to memory of 2588 2160 DFIR.exe 33 PID 2160 wrote to memory of 2588 2160 DFIR.exe 33 PID 2160 wrote to memory of 2588 2160 DFIR.exe 33 PID 2588 wrote to memory of 2624 2588 cmd.exe 34 PID 2588 wrote to memory of 2624 2588 cmd.exe 34 PID 2588 wrote to memory of 2624 2588 cmd.exe 34 PID 2160 wrote to memory of 2724 2160 DFIR.exe 35 PID 2160 wrote to memory of 2724 2160 DFIR.exe 35 PID 2160 wrote to memory of 2724 2160 DFIR.exe 35 PID 2724 wrote to memory of 2524 2724 cmd.exe 36 PID 2724 wrote to memory of 2524 2724 cmd.exe 36 PID 2724 wrote to memory of 2524 2724 cmd.exe 36 PID 2160 wrote to memory of 2656 2160 DFIR.exe 37 PID 2160 wrote to memory of 2656 2160 DFIR.exe 37 PID 2160 wrote to memory of 2656 2160 DFIR.exe 37 PID 2656 wrote to memory of 2616 2656 cmd.exe 38 PID 2656 wrote to memory of 2616 2656 cmd.exe 38 PID 2656 wrote to memory of 2616 2656 cmd.exe 38 PID 2656 wrote to memory of 2648 2656 cmd.exe 39 PID 2656 wrote to memory of 2648 2656 cmd.exe 39 PID 2656 wrote to memory of 2648 2656 cmd.exe 39 PID 2160 wrote to memory of 2396 2160 DFIR.exe 40 PID 2160 wrote to memory of 2396 2160 DFIR.exe 40 PID 2160 wrote to memory of 2396 2160 DFIR.exe 40 PID 2396 wrote to memory of 2044 2396 cmd.exe 41 PID 2396 wrote to memory of 2044 2396 cmd.exe 41 PID 2396 wrote to memory of 2044 2396 cmd.exe 41 PID 2160 wrote to memory of 2636 2160 DFIR.exe 42 PID 2160 wrote to memory of 2636 2160 DFIR.exe 42 PID 2160 wrote to memory of 2636 2160 DFIR.exe 42 PID 2636 wrote to memory of 1832 2636 cmd.exe 43 PID 2636 wrote to memory of 1832 2636 cmd.exe 43 PID 2636 wrote to memory of 1832 2636 cmd.exe 43 PID 2160 wrote to memory of 1592 2160 DFIR.exe 44 PID 2160 wrote to memory of 1592 2160 DFIR.exe 44 PID 2160 wrote to memory of 1592 2160 DFIR.exe 44 PID 1592 wrote to memory of 380 1592 cmd.exe 45 PID 1592 wrote to memory of 380 1592 cmd.exe 45 PID 1592 wrote to memory of 380 1592 cmd.exe 45 PID 2160 wrote to memory of 2052 2160 DFIR.exe 46 PID 2160 wrote to memory of 2052 2160 DFIR.exe 46 PID 2160 wrote to memory of 2052 2160 DFIR.exe 46 PID 2052 wrote to memory of 692 2052 cmd.exe 47 PID 2052 wrote to memory of 692 2052 cmd.exe 47 PID 2052 wrote to memory of 692 2052 cmd.exe 47 PID 2160 wrote to memory of 532 2160 DFIR.exe 48 PID 2160 wrote to memory of 532 2160 DFIR.exe 48 PID 2160 wrote to memory of 532 2160 DFIR.exe 48 PID 532 wrote to memory of 1764 532 cmd.exe 49 PID 532 wrote to memory of 1764 532 cmd.exe 49 PID 532 wrote to memory of 1764 532 cmd.exe 49 PID 2160 wrote to memory of 2080 2160 DFIR.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\DFIR.exe"C:\Users\Admin\AppData\Local\Temp\DFIR.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\cmd.execmd.exe /c "sc stop npf"2⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:2712
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "sc delete npf"2⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\sc.exesc delete npf3⤵
- Launches sc.exe
PID:2576
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\system32\sc.exesc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys3⤵
- Launches sc.exe
PID:2624
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "sc start npf"2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\sc.exesc start npf3⤵
- Launches sc.exe
PID:2524
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "netstat -ano | findstr TCP"2⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\NETSTAT.EXEnetstat -ano3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\system32\findstr.exefindstr TCP3⤵PID:2648
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2044
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1832
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:380
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:692
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1764
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2080
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1736
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:984
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:3060
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:912
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2568
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2504
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2424
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2668
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1620
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:1488
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1492
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:1804
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:888 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"4⤵
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:852
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1740
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2968
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2148
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:1692
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"4⤵PID:2524
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2620
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2700
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2688
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1612
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:1240
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2736
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:496
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1664 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"4⤵PID:1036
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:1820
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:2184
-
-
-
C:\Windows\system32\cmd.execmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk2⤵PID:2968
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk3⤵
- Modifies registry class
PID:1684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD50c0195c48b6b8582fa6f6373032118da
SHA1d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA25611bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
SHA512ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
-
Filesize
1KB
MD58afbb1177ab70f9d24dacd22a6793ee4
SHA1b7ba0a4bd964868922143bedb93470202c0bfef4
SHA25654f0d371f9918c81e3ce7a557d6da1ac4639995c5a6e409822f0e496d3a1d290
SHA5122d05fb6e7e39b499b27aed4a7adf77fce1dcedc335d969be157dec91a78ed7b839ba50887d5a6de1b6f3635ae7d35dc6cd1ec064590ef76fe3ae8443fdaa5624
-
Filesize
2.0MB
MD5a7013a2c7fd3a6168a7c0d9eed825c32
SHA1a3b6cf6090a425466606125aa881fdf56c1c2a67
SHA256a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd
SHA512e2e6e447806adb5d27c77f8dc32772fc49ba5532e255e1a38e92a404efccbc8f3d820d4d674a51968e5c3c1079cb834253232bf13e6ff9d437c7d0e2551ba49d
-
Filesize
105KB
MD5899a5bf1669610cdb78d322ac8d9358b
SHA180a2e420b99ffe294a523c6c6d87ed09dfc8d82b
SHA256ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b
SHA51241f2459793ac04e433d8471780e770417afac499dc3c5413877d4a4499656c9669c069d24e638d0aaf43af178a763acb656ffd34d710eb5e3c94682db1559056
-
Filesize
361KB
MD5a672f1cf00fa5ac3f4f59577f77d8c86
SHA1b68e64401d91c75cafa810086a35cd0838c61a4b
SHA25635aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117
SHA512a566e7571437be765279c915dd6e13f72203eff0dc3838a154fc137ed828e05644d650fd8432d1fb4c1e1d84ee00ef9bde90225c68c3ca8a5da349065e7ebfd6