Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
597s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
Virus Maker.rar
Resource
win7-20240221-en
General
-
Target
Virus Maker.rar
-
Size
82KB
-
MD5
d1f61793e7898df4b27e3345764ceca8
-
SHA1
f03b91146aeaf753b565620a022a238830ed56d4
-
SHA256
d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b
-
SHA512
6491767f6db68886d000b173306377f3b0bf2d6db765ce4c14139c9ad09fa44e6cb75489f3858e45c4000333d2ad517721f81cc48e94de25c75c17cac36bb617
-
SSDEEP
1536:S0s/fG5w2aRBBNACjLkvSrfqAbv0Zarjg5AfDLCNE3Ztg/776X95:5s/+uRBmvMfzrhfbD2NStk76N5
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 848 Virus Maker.exe 2248 setup.exe 1948 setup.exe 1404 setup.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Virus Maker.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Virus Maker.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 47 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Virus Maker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Virus Maker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Virus Maker.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Virus Maker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Virus Maker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Virus Maker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Virus Maker.exe -
Runs net.exe
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2616 7zFM.exe 848 Virus Maker.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2616 7zFM.exe Token: 35 2616 7zFM.exe Token: SeSecurityPrivilege 2616 7zFM.exe Token: 33 2508 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2508 AUDIODG.EXE Token: 33 2508 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2508 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2616 7zFM.exe 2616 7zFM.exe 2616 7zFM.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe 848 Virus Maker.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 848 Virus Maker.exe 904 mspaint.exe 904 mspaint.exe 904 mspaint.exe 904 mspaint.exe 1872 mspaint.exe 1872 mspaint.exe 1872 mspaint.exe 1872 mspaint.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2616 3068 cmd.exe 29 PID 3068 wrote to memory of 2616 3068 cmd.exe 29 PID 3068 wrote to memory of 2616 3068 cmd.exe 29 PID 2616 wrote to memory of 848 2616 7zFM.exe 32 PID 2616 wrote to memory of 848 2616 7zFM.exe 32 PID 2616 wrote to memory of 848 2616 7zFM.exe 32 PID 2616 wrote to memory of 848 2616 7zFM.exe 32 PID 848 wrote to memory of 844 848 Virus Maker.exe 34 PID 848 wrote to memory of 844 848 Virus Maker.exe 34 PID 848 wrote to memory of 844 848 Virus Maker.exe 34 PID 848 wrote to memory of 844 848 Virus Maker.exe 34 PID 844 wrote to memory of 2056 844 vbc.exe 36 PID 844 wrote to memory of 2056 844 vbc.exe 36 PID 844 wrote to memory of 2056 844 vbc.exe 36 PID 844 wrote to memory of 2056 844 vbc.exe 36 PID 2248 wrote to memory of 112 2248 setup.exe 38 PID 2248 wrote to memory of 112 2248 setup.exe 38 PID 2248 wrote to memory of 112 2248 setup.exe 38 PID 112 wrote to memory of 576 112 cmd.exe 40 PID 112 wrote to memory of 576 112 cmd.exe 40 PID 112 wrote to memory of 576 112 cmd.exe 40 PID 576 wrote to memory of 584 576 net.exe 41 PID 576 wrote to memory of 584 576 net.exe 41 PID 576 wrote to memory of 584 576 net.exe 41 PID 1948 wrote to memory of 1228 1948 setup.exe 44 PID 1948 wrote to memory of 1228 1948 setup.exe 44 PID 1948 wrote to memory of 1228 1948 setup.exe 44 PID 1228 wrote to memory of 2304 1228 cmd.exe 46 PID 1228 wrote to memory of 2304 1228 cmd.exe 46 PID 1228 wrote to memory of 2304 1228 cmd.exe 46 PID 2304 wrote to memory of 340 2304 net.exe 47 PID 2304 wrote to memory of 340 2304 net.exe 47 PID 2304 wrote to memory of 340 2304 net.exe 47 PID 1228 wrote to memory of 904 1228 cmd.exe 48 PID 1228 wrote to memory of 904 1228 cmd.exe 48 PID 1228 wrote to memory of 904 1228 cmd.exe 48 PID 1228 wrote to memory of 888 1228 cmd.exe 49 PID 1228 wrote to memory of 888 1228 cmd.exe 49 PID 1228 wrote to memory of 888 1228 cmd.exe 49 PID 888 wrote to memory of 2884 888 net.exe 50 PID 888 wrote to memory of 2884 888 net.exe 50 PID 888 wrote to memory of 2884 888 net.exe 50 PID 1228 wrote to memory of 1872 1228 cmd.exe 52 PID 1228 wrote to memory of 1872 1228 cmd.exe 52 PID 1228 wrote to memory of 1872 1228 cmd.exe 52 PID 1228 wrote to memory of 2728 1228 cmd.exe 53 PID 1228 wrote to memory of 2728 1228 cmd.exe 53 PID 1228 wrote to memory of 2728 1228 cmd.exe 53 PID 2728 wrote to memory of 2592 2728 net.exe 54 PID 2728 wrote to memory of 2592 2728 net.exe 54 PID 2728 wrote to memory of 2592 2728 net.exe 54
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Virus Maker.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Virus Maker.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe"C:\Users\Admin\AppData\Local\Temp\7zO83A429E6\Virus Maker.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uq0sx0cd\uq0sx0cd.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F6A250AD12C43E5A7046143FFDBE3.TMP"5⤵PID:2056
-
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2640
-
C:\Users\Admin\Desktop\setup.exe"C:\Users\Admin\Desktop\setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\system32\net.exenet user Admin *3⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin *4⤵PID:584
-
-
-
-
C:\Users\Admin\Desktop\setup.exe"C:\Users\Admin\Desktop\setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\net.exenet user Admin *3⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin *4⤵PID:340
-
-
-
C:\Windows\system32\mspaint.exemspaint.exe3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Windows\system32\net.exenet user Admin *3⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin *4⤵PID:2884
-
-
-
C:\Windows\system32\mspaint.exemspaint.exe3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Windows\system32\net.exenet user Admin *3⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin *4⤵PID:2592
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:380
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1204
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
C:\Users\Admin\Desktop\setup.exe"C:\Users\Admin\Desktop\setup.exe"1⤵
- Executes dropped EXE
PID:1404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5dfd67248a15e45d83c5f7fbb2221ddac
SHA123ed3c995437f8fbb198bc68ae5ebda675637b5e
SHA256f6a92dab6e38f074c056eb155be0097555ca5c3b8a98b0a9697edb0bb2b78aff
SHA512f8d5b2c75b5894af6dc0579848a7f044d4560d39e3220355153c725b75bf8ef545956e933068f604aebfe1d400bf3bd6451f2ccc52b665212abb091d18d95544
-
Filesize
3.7MB
MD5c00845708ee4e6cbaa628a0886076c4d
SHA1e011d28a40304957961654e62d00754a772fdee8
SHA25616f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092
SHA5122b6a09b934ad6076008ad1b8bc960b6c3bf39968275f9f46fe1afbed7228eb196b46172c175106da70af80ad78aafc327869e71860af6472c74867dba022fb59
-
Filesize
1KB
MD5d0c2c8f0be7ef1ccea989d8089f3d7cc
SHA15c8a21bf633cc99939c61c908ea716b7469dbc41
SHA256db56413477e3da765302fda8f2b982bd4d8d09e31cf08c1694c87b33eb2083bf
SHA512e7c8ec6cf5cce65e32fb05120fe97bb1426c81c93d264adefecd7413ffc2b127b2a0f5069ce17d72e013986fd5b73c536ff7b55cbdf5352a882ce1a8ebc92a96
-
Filesize
633B
MD5323a0a910110cc2645d39e8096eaefa9
SHA15b0d43ecb783e4e53f114b2853e0e85134352516
SHA256dc2a924f0cc6f2a105861c70cf9f1d83619cbaf6c69283cf0cf03c951537b41a
SHA512a5d7ebe2f443bc71afd95b35f52cc1da2471390906a6d1b3672b060ed32ede7ef6be6e36ff3ec4f03b04656ca855e6b5c3a7b86afcc2ae928963abee638029b8
-
Filesize
1KB
MD57f159f4fb9949412b94c6a570010bf76
SHA1cb53e9b530f55ed51f878272288bd30cf95bf507
SHA2566bc1b263d14e51a5a4b96c4be1b4341f9a7ca39715e65cafb7552cc2bd15c90f
SHA5126d23f6ebf8e85bf3cf7542034b7ba1f3c8537a206ceb1fefd8f97187974b6ee97c69b272aa929026ab3c482d535c6d4df245fa8585ad261a304089093c115b2d
-
Filesize
170B
MD513fd40fd0950b5f73b8090eea9b92598
SHA18c81f302f18dd50f6d4e69485873e79ecd9726cb
SHA2568d66f6e456a4087d8bdba64749752b87e0bb00baecf36f6f8b53655dacc23a96
SHA512147465c8883d0f5971427653a02f6df6b90506173f4008f1420ee1dd52642568b5a47cf48e3cc2532c4e37f0e06d1780413286e85e7ba078b432594e96118784
-
Filesize
1KB
MD58071879382994b1ff8e5e4ce397a4622
SHA1abc7cb821425ee073e049774416df84529b6cfe7
SHA2566ec31828c59974e1dd24b258455bd3cecd1e76faa0e9e26c02e659a37b494d46
SHA5126f71215974e5c42f6f457db0a9901f72017a643c493a8092ece7bf2af8274b0ca12de130985b393ed5e62c4b966d263db738fd08731625c588f5096b7dfa9617
-
Filesize
380KB
MD5fcbc64c9d2430f32c9c1280c248d0afd
SHA13b1d6c810b633d187b0713852cd283b69cde5ec4
SHA256c86e7333aa2e13a82ed8ad44e490ffcddcc8f8306bf9e7cf8c922d044da1ac7e
SHA512fa7e09caabef7f0dc9e7b96698bf7e57f28f066c01c88c60a0eb84b22fd9aada74722a5af121c479c24bc91a8ce29a29c58a1907a1284f28bcbed18b19b1f9ab
-
Filesize
1.3MB
MD525f1095f803f56316ed9bdb2ec042b3c
SHA14740111b9403b40dfd4a58eee1aa99652dc76d22
SHA2563ba173ad6f13f91e4f23a517798d72fe26e12ef7bf25ea04b144d587a832065c
SHA512afdf370125a5f55e2cbe99f9be0aa89e290daefc59ca33fa1eeaf4a3ac1d1c2df1f1630525a35a2de52964526ac5a882c40194d2172299c1655dbdcc4525b1a0
-
Filesize
634KB
MD5628ea346e3314dc9f1ca9bd4fbe0ac90
SHA144c1554954de32c8131a24db4ad68ded55901e78
SHA256c5c91877a01a453d63bceb58ed4f6b6234d3d3c497e1b290f7d2826aca6d3e4d
SHA512a881227dc599541d7f46b45ad9c3823a37c9299694141e643de11a32420d6f1bd7159569990d7b1ccf39f8e7485c557f91f2b82bbf564632cda2f91292d87399
-
Filesize
571KB
MD542936a0ad939ba3371852f66cc874621
SHA1a39b6b3ce0387c0b3d16c3e96eb3e26f113a838b
SHA256f238c7a3c4e0790dff5ef0fa62aac0eb505668383b2557b666b105481c6fc2c5
SHA512c5f15c20fc44a3216cc4b2d893dfdbb13ffaf50abfe7e149814193d1ba9e7bc62a3b471e536196847ca0a0d7432b58f6b1871395e522c563a41c6eaf14098a4c
-
Filesize
698KB
MD589f9bf289750f6e167beab54922bdf8b
SHA1f9432d25a8472d5f4a6e21f5b669061d5a861a09
SHA25621ee9dc7d0d8006c9c4ed9bea0e5e25c0cb206ff86567a70788efcbe26869ebf
SHA512029486e077a5ab49c5849e6bca73d331f62209d009cded16a2d38321fb5ff137c2761f2303e95279a98d820e822cf4e08d0486f6806aac6cd00b563fea91314d
-
Filesize
888KB
MD558e7f9beb3623b610d7e1521abe8749b
SHA1696ab5ff4e948fe0139ba68305f04f7e9ac4eed4
SHA256b9bb210436a3253dedab2fde6bf4e112c601192b6b275278ad8e1bd758919f77
SHA5124c58806b27ca29fd20b9433728b2a7de424545471485c295c13869a9231d14268f8fe52c589bf302c52dbc1273796491591ce9d1498cc002751dcf8909d35df9
-
Filesize
349KB
MD55dfcc1a294b4e333914d757574b19b45
SHA14f93dec8888f215d1c624f6140d063fcb312fbb5
SHA256625664f7bec3adba87a3454d12dfcc65c1dacf21f00b1d5f5747a0653ad0bc3a
SHA512738ce32ed4af46bd64745e69919fc27c6bfadc0bcc14cefba8e4da774bd95273bd316c090c945eefdf451dba10136578b02fa768f3888f3f01497662488e3e89
-
Filesize
952KB
MD596cdf97d7626510a0ed0b6de245a65e4
SHA1578f2849cb7f27b30033520faa0b2245928df608
SHA2566b2b9545354c4656bc94715154e96899a099e3db6a8ee45b388680c51ee9e8ff
SHA5126a1e7c262d362c38aa68a3a7513f6de1fb06346340bbf8c4cb280dcbf5250724bbe1c3845f4bbdaf119bafc4491f52be26d45fe287062b20e29ce7b20f5bc1b7
-
Filesize
842KB
MD50ccfb8b225d71a2e4d4da7ae440397eb
SHA1d1473c62245751822947afc83d0aa3499762bb71
SHA256969a74bdc42b788e785dc6d29605c7b2d2c4564e15258eda3c2ceea037eceaf2
SHA5121a2f0bc16fd82a99e7055149c23ff7732fd541adcb5eec716b74a865bc50ab883ba7f6feaed67764c53977ff99efbdc19f1b67e7200415b0392520817f9ccea0
-
Filesize
476KB
MD580a8125d58336b3fbaf1099236dbfac5
SHA1d3e502504d9f71d0675e8079f07b785ba575ece8
SHA256218d956ffadae00d686b93fbd26eeb37d3ea78a7a1daa5c451aa9d86b2d0ef1e
SHA5126ba2b4affd959d074426e72c2ab3d8571f2d04527a729d1a7dab4724da6eeefc6a2a627fd82b2e4894424dd3ffb16598e54433a6898921c3782b6816202b1414
-
Filesize
660KB
MD5194fe5f65bdd7e98a01f583a5f78737b
SHA1ad5078255b9ded67f3aae7c2a3e9a44aa3609a3f
SHA2561b3ec98e5228235fbc0c7a937fe2a181424d7c8e039fbee455f94090a7990d40
SHA512d2156d648738c31b36c02636356645a4173591fcc12e136b8fa2a96bc57f5a4bbc7338876902273c23f33a1ad56a073e0a27161e274da0bee110798070a43428
-
Filesize
544KB
MD5b496013654ffa6887197b736ae5e93ce
SHA1318081cf2264885d6b6cc5f0b27b6c7485b6ce43
SHA256b4219f5b83a689f2db607ae6dde662b2391f47b3bf47d8b3e0e3a4af617260c4
SHA51285d4a6f33ae94ea2759c773586853c83d53799156bbce776a4e13954298f9254a6b579c79aa839e08e3fbcf54ca134eb5e6d6bc35603c6a98fdf7e52477b1bea
-
Filesize
602KB
MD5b8cebd1753581109c34fa83ea323d19e
SHA14b302190aa672629674122a0389977d892fcf5a9
SHA25621134e6b008816f2bfe86ca6f47f96966f8c3355da5e32a9b94f4487e9f4f391
SHA512c77a11e4778766d7f7346bf2e6d276152fe5d59ea8815cc5166731e66c4c0c8277d75f6cb5ce567709f45725a2a83d0ce9c0099ddf05b32756257e47b2de9560
-
Filesize
761KB
MD53f86a177e82316bb4819d1eb97db5201
SHA12771451d1232ce6179a0783e0693151b310b9837
SHA2560e104a75f8b13b18c394f1c1a21d86af06be82f2dd8c026446bf0b3ddd432b96
SHA512985e2a7864f835476e29c7459e24f9d149a2bd7a558ac71b4b00dc6cb725c63aaae579ffd9d7c2f067fa408742dd74b9a372b35c9780e0ce1d8acdb1339af5b2
-
Filesize
793KB
MD5b4103f1b00e0b7f882f169a0fd16df4a
SHA17153afedb70e0e18f8fc9137be48b208cb8f8a1a
SHA2562303d2bd14f782a494e41aa70395f9aab4a0740633a98ab1c6b5463b207a1eb2
SHA512a5d96abfdfbb68eeef08abb237c5f2a6faca113e27fb12dee75d6950ab55b383a7e681e40351cbed7b969989244a78a0d59869a22e539687ce836fde01219b66
-
Filesize
444KB
MD51c29df8bf76edf743fe0eb7162220a27
SHA1b752745f307091c2b2ad50e922a2efce84d12c0a
SHA256e8cddedb7e1b95560ab1b76aa12e08e3d3996b82584736f7dce3f12b926c6b6b
SHA512de68d1d281101982c07bcd65685172e3a74ffc3affa2fb98b244957974aa9914e565e94a3afb95c76cf5e37846af7d35e30339a7b2219754ec2ad07813b254f5
-
Filesize
539KB
MD5352d81c43717dc189d6a179988a3af13
SHA1e39c4a7d9c88fc402356cee5997f664e59bfa662
SHA256c09f5c7236229a477943f53df74f13bfaeb2634861107567d2e98a1185cea6ef
SHA51232aab7d361752fb97982e1b95266f325c2b09504e1b016bbfd02ea2c7d4e57e306235abbe31c2b9213b924edce09a662d58e10c03853bc5a7c5aaecc4f3afb3e
-
Filesize
729KB
MD5abb5a30364538cb13b17427a9e4c16d6
SHA1e502ce3f3d10a53736423c6c3cfddab677be2379
SHA256c2546dc9e3598ae5e0c98f03e451017348226e07eec09474360c6af1ad892b08
SHA512ea4d525364ff3dabccce2ffbff4f0dd93d0dd3bdda37dd4b49c38f4b0dbdf6808c386ebf00d860256ebf6804fff5358fcb70427292c98546765437ba1ad9da1b
-
Filesize
507KB
MD56d499dcd1e4b8a9d95b2f528ace25a6c
SHA1e2ba7f40e740eccb0142e3b5e8dd9fb68de979b8
SHA256e195e67b9cb6a848b15c9bf07d55e5ec66bbd4e2118d1eec48d271a8d25f6c3d
SHA512f99c2e6c52ff12e9d51605878340467609e7afd2b58bb02efdc4df849fec7a66147df9f6fbd75d389290aab3dbe7fe197c8b22a0ce6adbbf31f2699972ae0b74
-
Filesize
412KB
MD52a3c076c3d881b960f275a235fa02005
SHA19b1198fb27d984db8e18d2e2d885feece8017f06
SHA256224bc4a82e6ea1934a75afb10e3f6b663c45065044900a38edf94fd321695a10
SHA5122f604c44fc9b440d2076c6e595f824001481ca92a1e6022f6632a9f3b7571b470cc4fb097abdc074c3b08f1158a2701e8bf8829e1f7745e0e79adfb6aff27658
-
Filesize
825KB
MD5c41f76c11226103a9f7c9cf5f18715f3
SHA18896dd3ace2fbb3b58ead2c99bf7df205f15f5cb
SHA2567a65deb574484807aa8dfc6a7455fe506e5cb35f6271a8fd7c314c3dc0926874
SHA512f910cb9eb89d069716c6a4042e3f56f9eea47c0e7a057b3b2ad94830fb7ac1267d5214c4e4b9d2c01712ea186f39a231a7d85fb84ae8f6335d600d22d319f30c
-
Filesize
8KB
MD59e41f4387671141dfc89b9fa6b504ee6
SHA1a676e2acb94f6a48e9738ff37189883a7514859b
SHA25680682a6f90bf1faf31da61c16e0fb844075e289d4ad226a491674a9650672a51
SHA51283c124c9104adc358cdb589d7001019613432c84fabf81e4343ade05d80f40e610058df6241ac68f0762ef727e2406d9a64440d070c4e6a12bcd57f0c994b990