Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 02:53
Behavioral task
behavioral1
Sample
fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe
Resource
win7-20240221-en
General
-
Target
fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe
-
Size
1.9MB
-
MD5
541a9d3031657ebc794dc43a70511384
-
SHA1
1c18826b93532c58a2a20ac1061e4309e7441867
-
SHA256
fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533
-
SHA512
fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22
-
SSDEEP
24576:s7USn+9Co5+54pIbtNSPouMVMOU93aBOR/UCtN0FSrSOdJw1EgfqBhR5OMqj6oxq:8qIZuMCso1U6Tda1lAeMsynjCM5x6
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral2/memory/2672-0-0x00000000007B0000-0x0000000000996000-memory.dmp family_zgrat_v1 behavioral2/files/0x0007000000023225-36.dat family_zgrat_v1 -
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 872 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4832 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4472 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3876 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5040 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4744 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3508 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4940 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2144 996 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 996 schtasks.exe 91 -
Detects executables packed with unregistered version of .NET Reactor 2 IoCs
resource yara_rule behavioral2/memory/2672-0-0x00000000007B0000-0x0000000000996000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/files/0x0007000000023225-36.dat INDICATOR_EXE_Packed_DotNetReactor -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Executes dropped EXE 1 IoCs
pid Process 5888 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 16 ipinfo.io -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\dllhost.exe fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe File created C:\Program Files (x86)\Windows Media Player\5940a34987c991 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1868 schtasks.exe 3876 schtasks.exe 5040 schtasks.exe 872 schtasks.exe 2652 schtasks.exe 4744 schtasks.exe 3508 schtasks.exe 4940 schtasks.exe 2144 schtasks.exe 4756 schtasks.exe 4832 schtasks.exe 4688 schtasks.exe 2028 schtasks.exe 1596 schtasks.exe 1880 schtasks.exe 4472 schtasks.exe 5100 schtasks.exe 4760 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 6108 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 1560 powershell.exe Token: SeDebugPrivilege 3396 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 3104 powershell.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 828 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 2284 powershell.exe Token: SeDebugPrivilege 3988 powershell.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 1084 powershell.exe Token: SeDebugPrivilege 3200 powershell.exe Token: SeDebugPrivilege 1472 powershell.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 4604 powershell.exe Token: SeDebugPrivilege 5888 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4604 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 110 PID 2672 wrote to memory of 4604 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 110 PID 2672 wrote to memory of 3988 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 111 PID 2672 wrote to memory of 3988 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 111 PID 2672 wrote to memory of 2284 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 112 PID 2672 wrote to memory of 2284 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 112 PID 2672 wrote to memory of 2516 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 113 PID 2672 wrote to memory of 2516 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 113 PID 2672 wrote to memory of 4412 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 114 PID 2672 wrote to memory of 4412 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 114 PID 2672 wrote to memory of 2796 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 115 PID 2672 wrote to memory of 2796 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 115 PID 2672 wrote to memory of 4372 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 116 PID 2672 wrote to memory of 4372 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 116 PID 2672 wrote to memory of 2452 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 117 PID 2672 wrote to memory of 2452 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 117 PID 2672 wrote to memory of 5076 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 118 PID 2672 wrote to memory of 5076 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 118 PID 2672 wrote to memory of 828 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 119 PID 2672 wrote to memory of 828 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 119 PID 2672 wrote to memory of 1084 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 120 PID 2672 wrote to memory of 1084 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 120 PID 2672 wrote to memory of 3396 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 121 PID 2672 wrote to memory of 3396 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 121 PID 2672 wrote to memory of 4064 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 122 PID 2672 wrote to memory of 4064 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 122 PID 2672 wrote to memory of 3104 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 123 PID 2672 wrote to memory of 3104 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 123 PID 2672 wrote to memory of 1560 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 124 PID 2672 wrote to memory of 1560 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 124 PID 2672 wrote to memory of 1472 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 125 PID 2672 wrote to memory of 1472 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 125 PID 2672 wrote to memory of 2744 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 126 PID 2672 wrote to memory of 2744 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 126 PID 2672 wrote to memory of 3200 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 127 PID 2672 wrote to memory of 3200 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 127 PID 2672 wrote to memory of 4324 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 145 PID 2672 wrote to memory of 4324 2672 fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe 145 PID 4324 wrote to memory of 5684 4324 cmd.exe 149 PID 4324 wrote to memory of 5684 4324 cmd.exe 149 PID 4324 wrote to memory of 6108 4324 cmd.exe 150 PID 4324 wrote to memory of 6108 4324 cmd.exe 150 PID 4324 wrote to memory of 5888 4324 cmd.exe 158 PID 4324 wrote to memory of 5888 4324 cmd.exe 158 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\lsass.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\dllhost.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\02aXpbHLU6.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:5684
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
PID:6108
-
-
C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5888
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\My Pictures\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\odt\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533f" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5541a9d3031657ebc794dc43a70511384
SHA11c18826b93532c58a2a20ac1061e4309e7441867
SHA256fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533
SHA512fd3df8395904bad5ab23ebc1ac21febac8a55ebfe390039cba6b35d47c41963e91cc17f6c2144b024dc1d100528beec5ab6ee337b8181fb7c6630c6fef5e3c22
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533.exe.log
Filesize1KB
MD5cb4338b342d00bfe6111ffee5cbfc2ed
SHA1fc16673b6833ad3cb00743a32868b859e90aa536
SHA256343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9
SHA5124bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5588e5b3406537204588ef39f4c84259f
SHA1c6056b8139c0796cc6272b7b71fca2085f62b785
SHA2563b7e7c56deb0f16483d67e60a42a5f0a58ee557790fe0f312d036e4ecc31f7f0
SHA512f85ea8f8f0c3ea56840a84f42a188f125c13cea8b23f86ddcce8eb28758e816dd6d871154dfe63d250ef369b153f72c587a7a8bccd0a2728b7bc922dd7436e96
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
218B
MD5a7756cb55e16d659278e3cdaea3202f0
SHA13aeb7f0bfbfe9302dc454c184811254871469e91
SHA256d7edcd05f3883ee36ff6629a205d73738fa71bfa38821b363502eab2973b5900
SHA5124ee4c7a06761dde7817b03f06315f5aa709ded5ea2285d3c546fa351c6c435284da53d35e59d2ca9fbf0f8f96e38309eb8c29dfb266ab539095b85fcdb6f0d17
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82