Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 17:26 UTC
Static task
static1
Behavioral task
behavioral1
Sample
07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe
Resource
win10v2004-20240226-en
General
-
Target
07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe
-
Size
455KB
-
MD5
83f0264b7d86368748269bff2e1df1b1
-
SHA1
c29d7c8881378753b5448ad7bf47c2f9efed7b40
-
SHA256
07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b
-
SHA512
2af4a681ccd1a1dcfd38029ee5720579868dcdf5f47ee633eeb59823d5b270293b88083ea0806b489784a157b222096b05ce466be9c3e60eb1602c1ec4e15525
-
SSDEEP
6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8bLpIh9jil:5pQD+mO5KWy/zrVbt4fcYQ9U9jI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2996 LSASS.exe 2568 LSASS.exe -
Loads dropped DLL 2 IoCs
pid Process 2996 LSASS.exe 2996 LSASS.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: LSASS.exe File opened (read-only) \??\Y: LSASS.exe File opened (read-only) \??\H: LSASS.exe File opened (read-only) \??\J: LSASS.exe File opened (read-only) \??\L: LSASS.exe File opened (read-only) \??\O: LSASS.exe File opened (read-only) \??\P: LSASS.exe File opened (read-only) \??\T: LSASS.exe File opened (read-only) \??\W: LSASS.exe File opened (read-only) \??\Z: LSASS.exe File opened (read-only) \??\E: LSASS.exe File opened (read-only) \??\I: LSASS.exe File opened (read-only) \??\R: LSASS.exe File opened (read-only) \??\S: LSASS.exe File opened (read-only) \??\V: LSASS.exe File opened (read-only) \??\G: LSASS.exe File opened (read-only) \??\M: LSASS.exe File opened (read-only) \??\U: LSASS.exe File opened (read-only) \??\X: LSASS.exe File opened (read-only) \??\N: LSASS.exe File opened (read-only) \??\Q: LSASS.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf LSASS.exe File opened for modification C:\autorun.inf LSASS.exe File created F:\autorun.inf LSASS.exe File opened for modification F:\autorun.inf LSASS.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\LSASS.exe 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe File opened for modification C:\Windows\LSASS.exe LSASS.exe File created C:\Windows\LSASS.exe 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2568 LSASS.exe 2568 LSASS.exe 2568 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe 2996 LSASS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2996 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 28 PID 2184 wrote to memory of 2996 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 28 PID 2184 wrote to memory of 2996 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 28 PID 2184 wrote to memory of 2996 2184 07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe 28 PID 2996 wrote to memory of 2564 2996 LSASS.exe 29 PID 2996 wrote to memory of 2564 2996 LSASS.exe 29 PID 2996 wrote to memory of 2564 2996 LSASS.exe 29 PID 2996 wrote to memory of 2564 2996 LSASS.exe 29 PID 2996 wrote to memory of 2288 2996 LSASS.exe 30 PID 2996 wrote to memory of 2288 2996 LSASS.exe 30 PID 2996 wrote to memory of 2288 2996 LSASS.exe 30 PID 2996 wrote to memory of 2288 2996 LSASS.exe 30 PID 2996 wrote to memory of 2568 2996 LSASS.exe 33 PID 2996 wrote to memory of 2568 2996 LSASS.exe 33 PID 2996 wrote to memory of 2568 2996 LSASS.exe 33 PID 2996 wrote to memory of 2568 2996 LSASS.exe 33 PID 2996 wrote to memory of 2524 2996 LSASS.exe 34 PID 2996 wrote to memory of 2524 2996 LSASS.exe 34 PID 2996 wrote to memory of 2524 2996 LSASS.exe 34 PID 2996 wrote to memory of 2524 2996 LSASS.exe 34 PID 2996 wrote to memory of 1704 2996 LSASS.exe 35 PID 2996 wrote to memory of 1704 2996 LSASS.exe 35 PID 2996 wrote to memory of 1704 2996 LSASS.exe 35 PID 2996 wrote to memory of 1704 2996 LSASS.exe 35 PID 2996 wrote to memory of 2028 2996 LSASS.exe 38 PID 2996 wrote to memory of 2028 2996 LSASS.exe 38 PID 2996 wrote to memory of 2028 2996 LSASS.exe 38 PID 2996 wrote to memory of 2028 2996 LSASS.exe 38 PID 2996 wrote to memory of 524 2996 LSASS.exe 39 PID 2996 wrote to memory of 524 2996 LSASS.exe 39 PID 2996 wrote to memory of 524 2996 LSASS.exe 39 PID 2996 wrote to memory of 524 2996 LSASS.exe 39 PID 2996 wrote to memory of 548 2996 LSASS.exe 42 PID 2996 wrote to memory of 548 2996 LSASS.exe 42 PID 2996 wrote to memory of 548 2996 LSASS.exe 42 PID 2996 wrote to memory of 548 2996 LSASS.exe 42 PID 2996 wrote to memory of 2644 2996 LSASS.exe 43 PID 2996 wrote to memory of 2644 2996 LSASS.exe 43 PID 2996 wrote to memory of 2644 2996 LSASS.exe 43 PID 2996 wrote to memory of 2644 2996 LSASS.exe 43 PID 2996 wrote to memory of 1692 2996 LSASS.exe 46 PID 2996 wrote to memory of 1692 2996 LSASS.exe 46 PID 2996 wrote to memory of 1692 2996 LSASS.exe 46 PID 2996 wrote to memory of 1692 2996 LSASS.exe 46 PID 2996 wrote to memory of 2780 2996 LSASS.exe 47 PID 2996 wrote to memory of 2780 2996 LSASS.exe 47 PID 2996 wrote to memory of 2780 2996 LSASS.exe 47 PID 2996 wrote to memory of 2780 2996 LSASS.exe 47 PID 2996 wrote to memory of 376 2996 LSASS.exe 52 PID 2996 wrote to memory of 376 2996 LSASS.exe 52 PID 2996 wrote to memory of 376 2996 LSASS.exe 52 PID 2996 wrote to memory of 376 2996 LSASS.exe 52 PID 2996 wrote to memory of 2812 2996 LSASS.exe 54 PID 2996 wrote to memory of 2812 2996 LSASS.exe 54 PID 2996 wrote to memory of 2812 2996 LSASS.exe 54 PID 2996 wrote to memory of 2812 2996 LSASS.exe 54 PID 2996 wrote to memory of 2500 2996 LSASS.exe 56 PID 2996 wrote to memory of 2500 2996 LSASS.exe 56 PID 2996 wrote to memory of 2500 2996 LSASS.exe 56 PID 2996 wrote to memory of 2500 2996 LSASS.exe 56 PID 2996 wrote to memory of 2096 2996 LSASS.exe 57 PID 2996 wrote to memory of 2096 2996 LSASS.exe 57 PID 2996 wrote to memory of 2096 2996 LSASS.exe 57 PID 2996 wrote to memory of 2096 2996 LSASS.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe"C:\Users\Admin\AppData\Local\Temp\07c3ce3bf73866b862cc67b9e5a797e5aa6d2f9101aa8d9ad65240f3b598f33b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\LSASS.exe"C:\Windows\LSASS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2564
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2288
-
-
C:\Users\Admin\LSASS.exe"C:\Users\Admin\LSASS.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2568
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2524
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1704
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2028
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:524
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:548
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2644
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1692
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2780
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:376
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2812
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2500
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2096
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2148
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1172
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2060
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1268
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1536
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1780
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1436
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1336
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2212
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2632
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1952
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2928
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2544
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1176
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2740
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2520
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2404
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2200
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2908
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1704
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1556
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:564
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2784
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1948
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1872
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1968
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1668
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1528
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2876
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2860
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1280
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2272
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2068
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1164
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1612
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1780
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1684
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2992
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1292
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2392
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1396
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:3036
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2556
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD564e9b935b673b67afbc08d3ea448b18d
SHA1aab5b09a370558818f899c77a142c75ab0a72469
SHA256ca67dfbefab08f4abb6a82057c73a3bb52f247451aeeb870641c49ebb459bfdc
SHA512eafbec575bda0045421fe0deb920db198e15fc0b52f98360eb12115be70fb3fb0b5d854da5a9ace01e31b06cbedb813fd1272a04c26e0f2d7198a8a71ba2fcfe
-
Filesize
190B
MD5b1445c7f646c6ca9a7597791af38d575
SHA191efaf63fa1f7a51ee2f9b1c3b0f8932f15439ce
SHA256220517d50470c86d94020cebcd03af286898e65338f468dc5f860dc04af2c88e
SHA512533349278b6d186f0f3947681e90dcc7f617e146736798e6fc23e79d61610f1f7b2e4b4241b296884622fbd6b1cf73dc694a852e05bf4235da8ed40b70c5683f
-
Filesize
455KB
MD5e7a90c870ec6b18b6f00de90e84c5862
SHA14ae2200ca300063c3638178b84395e7c2ad74f71
SHA256afbd9710bccd9f02392fe5bbe36384b8ba4b99f9ce0fec1ea5f65b5758cfadcc
SHA512e4d9085efe2ab355e222bb50be7cb51759574fb4eca8c317cf8cde4888d0f9935274e63a4bb4bfb7424fb1c116137141e57e358fc67cec4daa5b2a2569c3e8b5