Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
e124bb71f66ce8823770b0d2ad07c9a9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e124bb71f66ce8823770b0d2ad07c9a9.exe
Resource
win10v2004-20240226-en
General
-
Target
e124bb71f66ce8823770b0d2ad07c9a9.exe
-
Size
779KB
-
MD5
e124bb71f66ce8823770b0d2ad07c9a9
-
SHA1
86c93a1007da894d937d9136851dac45f3036604
-
SHA256
bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec
-
SHA512
2eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb
-
SSDEEP
12288:chkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aaiKOA0a2wi+8pJ:URmJkcoQricOIQxiZY1iaaiA0hwv8L
Malware Config
Signatures
-
Detect XtremeRAT payload 16 IoCs
resource yara_rule behavioral2/memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral2/memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" e124bb71f66ce8823770b0d2ad07c9a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} e124bb71f66ce8823770b0d2ad07c9a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation e124bb71f66ce8823770b0d2ad07c9a9.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Server.exe -
Executes dropped EXE 32 IoCs
pid Process 4852 Server.exe 1252 Server.exe 2664 Server.exe 3604 Server.exe 4912 Server.exe 4068 Server.exe 1620 Server.exe 1344 Server.exe 2816 Server.exe 1616 Server.exe 3512 Server.exe 2252 Server.exe 3500 Server.exe 1728 Server.exe 1340 Server.exe 4680 Server.exe 5056 Server.exe 3040 Server.exe 2380 Server.exe 1616 Server.exe 968 Server.exe 1612 Server.exe 4516 Server.exe 2816 Server.exe 4252 Server.exe 4416 Server.exe 1736 Server.exe 2532 Server.exe 2076 Server.exe 4544 Server.exe 3560 Server.exe 1344 Server.exe -
resource yara_rule behavioral2/memory/2144-14-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2664-48-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2816-83-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral2/memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" e124bb71f66ce8823770b0d2ad07c9a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" e124bb71f66ce8823770b0d2ad07c9a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023218-25.dat autoit_exe behavioral2/files/0x0007000000023218-26.dat autoit_exe behavioral2/files/0x0007000000023218-114.dat autoit_exe behavioral2/files/0x0007000000023218-264.dat autoit_exe -
Suspicious use of SetThreadContext 23 IoCs
description pid Process procid_target PID 2560 set thread context of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 3236 set thread context of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 4852 set thread context of 1252 4852 Server.exe 103 PID 1252 set thread context of 2664 1252 Server.exe 104 PID 4912 set thread context of 4068 4912 Server.exe 119 PID 3604 set thread context of 1620 3604 Server.exe 118 PID 1620 set thread context of 1344 1620 Server.exe 121 PID 4068 set thread context of 2816 4068 Server.exe 122 PID 1616 set thread context of 3512 1616 Server.exe 139 PID 3512 set thread context of 2252 3512 Server.exe 140 PID 3500 set thread context of 1340 3500 Server.exe 146 PID 1728 set thread context of 4680 1728 Server.exe 147 PID 1340 set thread context of 5056 1340 Server.exe 148 PID 4680 set thread context of 3040 4680 Server.exe 149 PID 2380 set thread context of 1612 2380 Server.exe 177 PID 1616 set thread context of 2816 1616 Server.exe 179 PID 4516 set thread context of 4252 4516 Server.exe 181 PID 968 set thread context of 4416 968 Server.exe 182 PID 1612 set thread context of 1736 1612 Server.exe 183 PID 2816 set thread context of 2532 2816 Server.exe 184 PID 4416 set thread context of 2076 4416 Server.exe 185 PID 4252 set thread context of 4544 4252 Server.exe 186 PID 3560 set thread context of 1344 3560 Server.exe 213 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe e124bb71f66ce8823770b0d2ad07c9a9.exe File created C:\Windows\InstallDir\Server.exe e124bb71f66ce8823770b0d2ad07c9a9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 4852 Server.exe 4852 Server.exe 4852 Server.exe 3604 Server.exe 3604 Server.exe 4912 Server.exe 4912 Server.exe 4912 Server.exe 3604 Server.exe 1616 Server.exe 1616 Server.exe 1616 Server.exe 3500 Server.exe 3500 Server.exe 1728 Server.exe 1728 Server.exe 3500 Server.exe 1728 Server.exe 2380 Server.exe 2380 Server.exe 2380 Server.exe 1616 Server.exe 1616 Server.exe 4516 Server.exe 4516 Server.exe 968 Server.exe 968 Server.exe 1616 Server.exe 4516 Server.exe 968 Server.exe 3560 Server.exe 3560 Server.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 4852 Server.exe 4852 Server.exe 4852 Server.exe 3604 Server.exe 3604 Server.exe 4912 Server.exe 4912 Server.exe 4912 Server.exe 3604 Server.exe 1616 Server.exe 1616 Server.exe 1616 Server.exe 3500 Server.exe 3500 Server.exe 1728 Server.exe 1728 Server.exe 3500 Server.exe 1728 Server.exe 2380 Server.exe 2380 Server.exe 2380 Server.exe 1616 Server.exe 1616 Server.exe 4516 Server.exe 4516 Server.exe 968 Server.exe 968 Server.exe 1616 Server.exe 4516 Server.exe 968 Server.exe 3560 Server.exe 3560 Server.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 1252 Server.exe 4068 Server.exe 1620 Server.exe 3512 Server.exe 1340 Server.exe 4680 Server.exe 1612 Server.exe 2816 Server.exe 4416 Server.exe 4252 Server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 2560 wrote to memory of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 2560 wrote to memory of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 2560 wrote to memory of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 2560 wrote to memory of 3236 2560 e124bb71f66ce8823770b0d2ad07c9a9.exe 89 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 3236 wrote to memory of 2144 3236 e124bb71f66ce8823770b0d2ad07c9a9.exe 90 PID 2144 wrote to memory of 4568 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 93 PID 2144 wrote to memory of 4568 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 93 PID 2144 wrote to memory of 4568 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 93 PID 2144 wrote to memory of 4568 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 93 PID 2144 wrote to memory of 4860 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 94 PID 2144 wrote to memory of 4860 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 94 PID 2144 wrote to memory of 4860 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 94 PID 2144 wrote to memory of 2680 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 95 PID 2144 wrote to memory of 2680 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 95 PID 2144 wrote to memory of 2680 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 95 PID 2144 wrote to memory of 3080 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 96 PID 2144 wrote to memory of 3080 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 96 PID 2144 wrote to memory of 3080 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 96 PID 2144 wrote to memory of 4812 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 97 PID 2144 wrote to memory of 4812 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 97 PID 2144 wrote to memory of 4812 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 97 PID 2144 wrote to memory of 2980 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 98 PID 2144 wrote to memory of 2980 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 98 PID 2144 wrote to memory of 2980 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 98 PID 2144 wrote to memory of 1092 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 99 PID 2144 wrote to memory of 1092 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 99 PID 2144 wrote to memory of 1092 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 99 PID 2144 wrote to memory of 4448 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 100 PID 2144 wrote to memory of 4448 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 100 PID 2144 wrote to memory of 4448 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 100 PID 2144 wrote to memory of 3008 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 101 PID 2144 wrote to memory of 3008 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 101 PID 2144 wrote to memory of 4852 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 102 PID 2144 wrote to memory of 4852 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 102 PID 2144 wrote to memory of 4852 2144 e124bb71f66ce8823770b0d2ad07c9a9.exe 102 PID 4852 wrote to memory of 1252 4852 Server.exe 103 PID 4852 wrote to memory of 1252 4852 Server.exe 103 PID 4852 wrote to memory of 1252 4852 Server.exe 103 PID 4852 wrote to memory of 1252 4852 Server.exe 103 PID 4852 wrote to memory of 1252 4852 Server.exe 103 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 1252 wrote to memory of 2664 1252 Server.exe 104 PID 2664 wrote to memory of 4652 2664 Server.exe 105 PID 2664 wrote to memory of 4652 2664 Server.exe 105 PID 2664 wrote to memory of 4652 2664 Server.exe 105 PID 2664 wrote to memory of 3892 2664 Server.exe 106 PID 2664 wrote to memory of 3892 2664 Server.exe 106 PID 2664 wrote to memory of 3892 2664 Server.exe 106 PID 2664 wrote to memory of 4464 2664 Server.exe 107 PID 2664 wrote to memory of 4464 2664 Server.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"3⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:4568 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3604 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1620 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4664
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1728 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4680 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:3040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:4900
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1616 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"13⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:2532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"14⤵PID:3732
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1616 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3512 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:3028
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4516 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4252 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:4544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵PID:3308
-
-
-
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2380 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:1736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵PID:1732
-
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3560 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Executes dropped EXE
PID:1344
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵PID:3008
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵PID:3960
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4068 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"9⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"10⤵PID:4644
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3500 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"12⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:5056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵PID:4036
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:968 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4416 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"15⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:2076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"16⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5440dfc3d54ba50cb33551a8634602bd4
SHA1541ee562011594bbb9e701ef42efabf3703a74dd
SHA2564a2ea3e7d16f176b2fa28b9987346b27357a39fcd31f0398c35c5465daf22691
SHA512cba333af21a6029d9a009d6eb5de608b012b9a57bff78e0404ae188c0cd61d4f6d8c4ae8424554caaac81883693e3d1101a15f745f0d8d5f7f50270f7fd7a3ce
-
Filesize
1KB
MD5e231aa3a824bc2656dd5c40ff89cf0fa
SHA1de77ca52ef1f4b3a1a58d86d10c28c6450337671
SHA256c346b0ae9b3b77df71b917d17c5578764becae7b9070420d70fa21daf5f1f2de
SHA5129c7ef344681df07ebe2fb8f3674d3e02db50256147773cedc844fe0a13deac70d6c85385256571b461c039a6ca913bceb48d50517e520e32726953b2455484e4
-
Filesize
128KB
MD5c2888648d79cfbc8ea44e9f20bbd604f
SHA19694449f996a4e30f2eb43b557ed027343b5f25a
SHA25627c4833ec00bbc023ea8913fff23fca4f32b507713dbc97e1bbc833b8b0c7631
SHA512d987dec835a53845536d118ecf6e8e288167f0ecf88a6002ad3f03b6bb9e898d16f6622109a40d3e0e033bb1b223311979bcd68da95e2a3a7a478d9194328abc
-
Filesize
615KB
MD52061cd8e9a166b6503fc2edc9e39f453
SHA175adef444266d9378e1f6da324aa455d467999b1
SHA256b3fd18b2a4eb2536e510740ab1b7f829a859ca8a64bb9cc0c642a846d45d54dd
SHA5128cc5fd024bb1e5dc941f2cade7b331449464ceba8828608996f40e521ad0c5ee1073c5b93554021f9695aa3867437c0a0a2d0f47126c3e060a1ca5b87e064786
-
Filesize
779KB
MD5e124bb71f66ce8823770b0d2ad07c9a9
SHA186c93a1007da894d937d9136851dac45f3036604
SHA256bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec
SHA5122eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb
-
Filesize
768KB
MD56d0ca1137c55557e9caffeae2bb96404
SHA12b45411801f18a413e96bd41ad7caa70d9f6bfc5
SHA2567ed34f24be66eac64c10816f845af3ac7dccd1fdeacb49dde168571cd1716618
SHA5124ae504960c31c31232313c497d940478b8bd96c9743649b534c7e71235ba79462645098a882293a1f1db393a6d6272d4932e3530d2f8bda3f1294e9b9e62154e