Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
Resource
win10v2004-20240226-en
General
-
Target
SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe
-
Size
435KB
-
MD5
2ff5504c8b803e79dade34401c89701d
-
SHA1
87d626130cfcb4f3984a4b7ab74f956fe4f13b60
-
SHA256
ee6411869e495253cbbfc96932f262dbe199277a319aad8654c30f54534da109
-
SHA512
c2c11c0075efb5b2a72cb10ad17221482790b0081fdefb1512df8cddfe7f50aa13a22d9e654c4461109ff8c5063cb3f49e5f890afce2c2f0e46d5117895d74d2
-
SSDEEP
12288:TDr0C0xkXVXvNxeNOo2nLNsllllJsllllhi:TDr0C0xkXVXiNMnL4
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET81EC.tmp DrvInst.exe File created C:\Windows\system32\DRIVERS\SET81EC.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\dfmirage.sys DrvInst.exe -
Executes dropped EXE 1 IoCs
pid Process 2168 MirrInst64.exe -
Loads dropped DLL 1 IoCs
pid Process 1956 cmd.exe -
Drops file in System32 directory 28 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\SET4442.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\SET4452.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat MirrInst64.exe File opened for modification C:\Windows\system32\dfmirage.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File created C:\Windows\system32\SET8299.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\dfmirage.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\SET4452.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_neutral_83b5f055f9286973\dfmirage.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\dfmirage.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\SET4463.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\dfmirage.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\SET4441.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\SET4441.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat MirrInst64.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_neutral_83b5f055f9286973\dfmirage.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\dfmirage.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\x64\SET4442.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2f398bf8-9a53-7d20-a0d8-324b655f8215}\SET4463.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MirrInst64.exe File opened for modification C:\Windows\system32\SET8299.tmp DrvInst.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\setuperr.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\setupact.log MirrInst64.exe File opened for modification C:\Windows\INF\setupapi.ev2 DrvInst.exe File opened for modification C:\Windows\setuperr.log MirrInst64.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MirrInst64.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File created C:\Windows\INF\oem2.PNF MirrInst64.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\setupact.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2744 DrvInst.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2168 MirrInst64.exe Token: SeLoadDriverPrivilege 2168 MirrInst64.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeRestorePrivilege 2088 DrvInst.exe Token: SeLoadDriverPrivilege 2088 DrvInst.exe Token: SeLoadDriverPrivilege 2088 DrvInst.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2212 wrote to memory of 1956 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 31 PID 2212 wrote to memory of 1956 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 31 PID 2212 wrote to memory of 1956 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 31 PID 2212 wrote to memory of 1956 2212 SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe 31 PID 1956 wrote to memory of 2628 1956 cmd.exe 33 PID 1956 wrote to memory of 2628 1956 cmd.exe 33 PID 1956 wrote to memory of 2628 1956 cmd.exe 33 PID 1956 wrote to memory of 2628 1956 cmd.exe 33 PID 1956 wrote to memory of 2072 1956 cmd.exe 34 PID 1956 wrote to memory of 2072 1956 cmd.exe 34 PID 1956 wrote to memory of 2072 1956 cmd.exe 34 PID 1956 wrote to memory of 2072 1956 cmd.exe 34 PID 1956 wrote to memory of 1664 1956 cmd.exe 35 PID 1956 wrote to memory of 1664 1956 cmd.exe 35 PID 1956 wrote to memory of 1664 1956 cmd.exe 35 PID 1956 wrote to memory of 1664 1956 cmd.exe 35 PID 1956 wrote to memory of 2008 1956 cmd.exe 36 PID 1956 wrote to memory of 2008 1956 cmd.exe 36 PID 1956 wrote to memory of 2008 1956 cmd.exe 36 PID 1956 wrote to memory of 2008 1956 cmd.exe 36 PID 1956 wrote to memory of 2168 1956 cmd.exe 37 PID 1956 wrote to memory of 2168 1956 cmd.exe 37 PID 1956 wrote to memory of 2168 1956 cmd.exe 37 PID 1956 wrote to memory of 2168 1956 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Agent_AGen.ABZ.tr.30631.16009.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\Install.cmd"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵PID:2628
-
-
C:\Windows\SysWOW64\find.exefind "5.0"3⤵PID:2072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "3⤵PID:1664
-
-
C:\Windows\SysWOW64\find.exefind "5.1"3⤵PID:2008
-
-
C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\MirrInst64.exe"C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\MirrInst64.exe" -i "dfmirage" "Mirage Driver" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105\" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105\dfmirage.inf"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5723ca06-2101-1001-92b2-bc1c488bef7c}\dfmirage.inf" "9" "6fc89b15f" "0000000000000498" "WinSta0\Default" "00000000000005A8" "208" "C:\Users\Public\Documents\Koino\ManualLauncher\AnySupport\HOST_GOV1\RACE\105"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem2.inf" "dfmirage.inf:DFMirage.Mfg.NTamd64:DFMirage:2.0.105.0:dfmirage" "670102fe7" "00000000000003E8" "00000000000004A0" "00000000000004AC"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD598eb0b62c3fe53eac8caa8fdb58020ee
SHA1cbfe9eb43b3b37fe0dfbc4c2eb2d4e07d08bd8e8
SHA2564422e963ee53cd58cc9f85cd40bf5ffec0095fdf1a154535661c1c06bcadc69b
SHA51272da2faa578609e401a770d5a6f1b5e645e3bd8efbd8ab91d7fb38def5fd9f953ec2583027b1ad10c62d90d3adbf63c8e4261a4f6e4f5192b5ab2db7de348fc7
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2E65A6A42ABC9FC2CAFCAC0D497867D5
Filesize248B
MD513a5b3d329aa8eab6272af5eb9f0c6cd
SHA16258297f2903e4753ea73453a08b687da81fc035
SHA25651abb8db20a59b75750215b1082b7431acf51eaf1c195e19cf1adfc9577cae87
SHA512ba75e230c86ba8b91835d6c6d1976300ef911ee1e1d96d1744eb60708bf597d1f79d011e951ff0e10ad172546bc45c417d1fe7e2042d11807c9e8e3848eae971
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
39KB
MD54e7cd3d45fe3c9c60a8163c66de156cc
SHA10a6278e6ec7c4c3a75ec25cc47d19f643cee4927
SHA25687308c9b7ecd835c7ae58a3eb6e5b8474977a420e5e3c978b798ff8d175779f1
SHA512bbc4bf06fcb45efac7ac41a9d5fd8c7b1601c9a948966c250677e2e6793d6d56bd1a87854387a81b3ad7b70ad39573f4a14a345bbd1c119ee7af9beb4f6b0cd7
-
Filesize
35KB
MD5178a6e9a0dce42959fc5ad129f60cba9
SHA1f1f29ad0ac605d4afda852f57401d762ab20b49b
SHA256215cb36c6178d47caa6600b4ca7036dceff412141be4511ed7220a1831820355
SHA512f6af4d204b49f4d5ad84d64f9ccb2676a8a2ba51794e0220beeda7dd5d7702200b3c04f7d5a8290f3f7f24cfb1036a87aba2a829137fbf54fd904f36d0bcd5f4
-
Filesize
11KB
MD5964bd2583871d246f0a01ca9e51abd9d
SHA1a871efcba882911684e39a6220557a2d3e7e5cc5
SHA25628200fbd0236e2b1ab2d0d615d45c1672ee4f4b7521fcaae52f7225eb124303c
SHA5121e91007a578b3da6ea278f5d61cb60e91e16077df2f68bf47424bb76175c12b88c003aee3e3b639510f61f20d22596cfb61bbe516383d02df546eea67a6409a9
-
Filesize
2KB
MD5fca869ed2e4441a235ee85ef3c35e92f
SHA1f8710a2bfc7091b909ef990f18e70630b3ddea84
SHA25671aa40b8a284ea119da69dfcc2e1bf79eda0a1696c09934c93ea2109ca806c4f
SHA5128df3820fa92dd7acb70d2ecb09a38fc262ad6acae97a4dd7fb1594fb02aa0ea9e175c373aa536dc5e063cf4e9b6f82e4c107a1551781fe03571c259579094601
-
Filesize
899B
MD5e5b4d641c72c9938595a4fd224e6ad1f
SHA1222bee618179b66437e0d9c4be3a52b159eeef06
SHA2566dd2494e7619d54ab4c817b5f0933d0b0ac90a6781d79d0d76b9b190bbb1f74c
SHA512d3712675bf26af6762406b3fe2a1bebccc0187a93ad3752c8845a2a50462297657221aa655671c4048e5114cfc5a3fd3665b6c84f9af7373af7f30242e6021d7
-
Filesize
8KB
MD56758710720db7e6cc75826fad9597437
SHA17fcce36c94ea6bfd53c55923294402f834ab9365
SHA256a597df7ec8b2c0114ebc36dc7e2fc45ed1a8684a3bb609ff739bc8f8279df8ce
SHA5124eb67eec3e4bfe70226f20fc793ed18d661a9c709cc95f2a51555978cecd0b54eff6323eff1ce73db929f9ae90eb6275e7cd6d75c020b56948ee32eb93d7e372
-
C:\Windows\System32\DriverStore\FileRepository\dfmirage.inf_amd64_neutral_83b5f055f9286973\dfmirage.PNF
Filesize8KB
MD51d30402a42ce1222828da3a169813e17
SHA1f815ab9e58299656d94b0c69722863f14c7ee29e
SHA25605a5fd597acc92b880d6da980b740bf92298818d3f54d0fe815f1f530e297f64
SHA512144c0c2bc3c87b97f971ec5f8a34f3e299508caa9c858071bdd462950a515d7e36d1258010739f3295a80eca18cef46457cc0f6375c6d74347e4c3568a1d8b9c
-
Filesize
1.4MB
MD58fafefd432a4d4b2ff0ba40826bc3684
SHA126345eac5d26fd294987f5526a1b906412047088
SHA2568325101f3db6a4d913efd14806d8a046446e902de5fcc7ac4f46ce31e3b8f507
SHA512afde897ac9b845a57b4345dc8736923f51bbddfaeaffbe444f8fa724ea2a5d298f620fc64fdb3630eece13a6d90e26c1a7836fc8213c86757186f82d0e2a579b
-
Filesize
155KB
MD5f6e2d04ee7babdb2dfd80e6c5b79724c
SHA125c35e90ad036ef69d57041293401328187b209c
SHA25627e90fb741b042c3ea596b8323f42fec9fd6432a24efa0d3553cfcf381eebca9
SHA51261be219951000bf95393129a97f19dfdf3f94159d097c6f20a6aef991b8f1d3b8e0533ba33e0cae647c48962d9aa5b385e5934b62b514b175e398c5d64665a94