Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 07:42

General

  • Target

    e124bb71f66ce8823770b0d2ad07c9a9.exe

  • Size

    779KB

  • MD5

    e124bb71f66ce8823770b0d2ad07c9a9

  • SHA1

    86c93a1007da894d937d9136851dac45f3036604

  • SHA256

    bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec

  • SHA512

    2eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb

  • SSDEEP

    12288:chkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aaiKOA0a2wi+8pJ:URmJkcoQricOIQxiZY1iaaiA0hwv8L

Malware Config

Signatures

  • Detect XtremeRAT payload 16 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 24 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 23 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
    "C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
      "C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe
        "C:\Users\Admin\AppData\Local\Temp\e124bb71f66ce8823770b0d2ad07c9a9.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Checks computer location settings
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          4⤵
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          PID:4568
          • C:\Windows\InstallDir\Server.exe
            "C:\Windows\InstallDir\Server.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3604
            • C:\Windows\InstallDir\Server.exe
              "C:\Windows\InstallDir\Server.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:1620
              • C:\Windows\InstallDir\Server.exe
                "C:\Windows\InstallDir\Server.exe"
                7⤵
                • Modifies Installed Components in the registry
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                PID:1344
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  8⤵
                    PID:4988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                    8⤵
                      PID:4340
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                      8⤵
                        PID:4028
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                        8⤵
                          PID:468
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                          8⤵
                            PID:2180
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                            8⤵
                              PID:312
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                              8⤵
                                PID:5040
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                8⤵
                                  PID:4664
                                • C:\Windows\InstallDir\Server.exe
                                  "C:\Windows\InstallDir\Server.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:1728
                                  • C:\Windows\InstallDir\Server.exe
                                    "C:\Windows\InstallDir\Server.exe"
                                    9⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4680
                                    • C:\Windows\InstallDir\Server.exe
                                      "C:\Windows\InstallDir\Server.exe"
                                      10⤵
                                      • Modifies Installed Components in the registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3040
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                        11⤵
                                          PID:2336
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                          11⤵
                                            PID:1568
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                            11⤵
                                              PID:1244
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                              11⤵
                                                PID:2280
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                11⤵
                                                  PID:3168
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                  11⤵
                                                    PID:2632
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                    11⤵
                                                      PID:3076
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                      11⤵
                                                        PID:4900
                                                      • C:\Windows\InstallDir\Server.exe
                                                        "C:\Windows\InstallDir\Server.exe"
                                                        11⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:1616
                                                        • C:\Windows\InstallDir\Server.exe
                                                          "C:\Windows\InstallDir\Server.exe"
                                                          12⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2816
                                                          • C:\Windows\InstallDir\Server.exe
                                                            "C:\Windows\InstallDir\Server.exe"
                                                            13⤵
                                                            • Modifies Installed Components in the registry
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            PID:2532
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                              14⤵
                                                                PID:2380
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                14⤵
                                                                  PID:1616
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                  14⤵
                                                                    PID:4372
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                    14⤵
                                                                      PID:748
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                      14⤵
                                                                        PID:5088
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                        14⤵
                                                                          PID:3732
                                                      • C:\Windows\InstallDir\Server.exe
                                                        "C:\Windows\InstallDir\Server.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:1616
                                                        • C:\Windows\InstallDir\Server.exe
                                                          "C:\Windows\InstallDir\Server.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3512
                                                          • C:\Windows\InstallDir\Server.exe
                                                            "C:\Windows\InstallDir\Server.exe"
                                                            7⤵
                                                            • Modifies Installed Components in the registry
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            PID:2252
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                              8⤵
                                                                PID:3204
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                8⤵
                                                                  PID:1060
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                  8⤵
                                                                    PID:2944
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                    8⤵
                                                                      PID:4984
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                      8⤵
                                                                        PID:896
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                        8⤵
                                                                          PID:2424
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                          8⤵
                                                                            PID:4216
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                            8⤵
                                                                              PID:3028
                                                                            • C:\Windows\InstallDir\Server.exe
                                                                              "C:\Windows\InstallDir\Server.exe"
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:4516
                                                                              • C:\Windows\InstallDir\Server.exe
                                                                                "C:\Windows\InstallDir\Server.exe"
                                                                                9⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4252
                                                                                • C:\Windows\InstallDir\Server.exe
                                                                                  "C:\Windows\InstallDir\Server.exe"
                                                                                  10⤵
                                                                                  • Modifies Installed Components in the registry
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  PID:4544
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                    11⤵
                                                                                      PID:5056
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                      11⤵
                                                                                        PID:2208
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                        11⤵
                                                                                          PID:2616
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                          11⤵
                                                                                            PID:3360
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                            11⤵
                                                                                              PID:3836
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                              11⤵
                                                                                                PID:3308
                                                                                  • C:\Windows\InstallDir\Server.exe
                                                                                    "C:\Windows\InstallDir\Server.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:2380
                                                                                    • C:\Windows\InstallDir\Server.exe
                                                                                      "C:\Windows\InstallDir\Server.exe"
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1612
                                                                                      • C:\Windows\InstallDir\Server.exe
                                                                                        "C:\Windows\InstallDir\Server.exe"
                                                                                        7⤵
                                                                                        • Modifies Installed Components in the registry
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        PID:1736
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                          8⤵
                                                                                            PID:4640
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                            8⤵
                                                                                              PID:1640
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                              8⤵
                                                                                                PID:1588
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                8⤵
                                                                                                  PID:1436
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                  8⤵
                                                                                                    PID:2880
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                    8⤵
                                                                                                      PID:1732
                                                                                              • C:\Windows\InstallDir\Server.exe
                                                                                                "C:\Windows\InstallDir\Server.exe"
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:3560
                                                                                                • C:\Windows\InstallDir\Server.exe
                                                                                                  "C:\Windows\InstallDir\Server.exe"
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1344
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                              4⤵
                                                                                                PID:4860
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                4⤵
                                                                                                  PID:2680
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                  4⤵
                                                                                                    PID:3080
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                    4⤵
                                                                                                      PID:4812
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                      4⤵
                                                                                                        PID:2980
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                        4⤵
                                                                                                          PID:1092
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                          4⤵
                                                                                                            PID:4448
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                            4⤵
                                                                                                              PID:3008
                                                                                                            • C:\Windows\InstallDir\Server.exe
                                                                                                              "C:\Windows\InstallDir\Server.exe"
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4852
                                                                                                              • C:\Windows\InstallDir\Server.exe
                                                                                                                "C:\Windows\InstallDir\Server.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1252
                                                                                                                • C:\Windows\InstallDir\Server.exe
                                                                                                                  "C:\Windows\InstallDir\Server.exe"
                                                                                                                  6⤵
                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2664
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                    7⤵
                                                                                                                      PID:4652
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                      7⤵
                                                                                                                        PID:3892
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                        7⤵
                                                                                                                          PID:4464
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                          7⤵
                                                                                                                            PID:3872
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                            7⤵
                                                                                                                              PID:4952
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                              7⤵
                                                                                                                                PID:2720
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                7⤵
                                                                                                                                  PID:3712
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:3960
                                                                                                                                  • C:\Windows\InstallDir\Server.exe
                                                                                                                                    "C:\Windows\InstallDir\Server.exe"
                                                                                                                                    7⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                    PID:4912
                                                                                                                                    • C:\Windows\InstallDir\Server.exe
                                                                                                                                      "C:\Windows\InstallDir\Server.exe"
                                                                                                                                      8⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:4068
                                                                                                                                      • C:\Windows\InstallDir\Server.exe
                                                                                                                                        "C:\Windows\InstallDir\Server.exe"
                                                                                                                                        9⤵
                                                                                                                                        • Modifies Installed Components in the registry
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:2816
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                          10⤵
                                                                                                                                            PID:4064
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                            10⤵
                                                                                                                                              PID:3408
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                              10⤵
                                                                                                                                                PID:4468
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                10⤵
                                                                                                                                                  PID:3608
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                  10⤵
                                                                                                                                                    PID:1248
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                    10⤵
                                                                                                                                                      PID:2136
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                      10⤵
                                                                                                                                                        PID:4040
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                        10⤵
                                                                                                                                                          PID:4644
                                                                                                                                                        • C:\Windows\InstallDir\Server.exe
                                                                                                                                                          "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                          10⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                          PID:3500
                                                                                                                                                          • C:\Windows\InstallDir\Server.exe
                                                                                                                                                            "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                            11⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:1340
                                                                                                                                                            • C:\Windows\InstallDir\Server.exe
                                                                                                                                                              "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                              12⤵
                                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              PID:5056
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                13⤵
                                                                                                                                                                  PID:4912
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                  13⤵
                                                                                                                                                                    PID:3780
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                    13⤵
                                                                                                                                                                      PID:4848
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                      13⤵
                                                                                                                                                                        PID:4996
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                        13⤵
                                                                                                                                                                          PID:2768
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                          13⤵
                                                                                                                                                                            PID:1604
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                            13⤵
                                                                                                                                                                              PID:1740
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                              13⤵
                                                                                                                                                                                PID:4036
                                                                                                                                                                              • C:\Windows\InstallDir\Server.exe
                                                                                                                                                                                "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                                                13⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                PID:968
                                                                                                                                                                                • C:\Windows\InstallDir\Server.exe
                                                                                                                                                                                  "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                                                  14⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:4416
                                                                                                                                                                                  • C:\Windows\InstallDir\Server.exe
                                                                                                                                                                                    "C:\Windows\InstallDir\Server.exe"
                                                                                                                                                                                    15⤵
                                                                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    PID:2076
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                      16⤵
                                                                                                                                                                                        PID:3200
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                        16⤵
                                                                                                                                                                                          PID:2924
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                          16⤵
                                                                                                                                                                                            PID:4784
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                            16⤵
                                                                                                                                                                                              PID:2428
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                              16⤵
                                                                                                                                                                                                PID:1488
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                16⤵
                                                                                                                                                                                                  PID:3040

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aut5D91.tmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    134KB

                                                                                                                                                                    MD5

                                                                                                                                                                    440dfc3d54ba50cb33551a8634602bd4

                                                                                                                                                                    SHA1

                                                                                                                                                                    541ee562011594bbb9e701ef42efabf3703a74dd

                                                                                                                                                                    SHA256

                                                                                                                                                                    4a2ea3e7d16f176b2fa28b9987346b27357a39fcd31f0398c35c5465daf22691

                                                                                                                                                                    SHA512

                                                                                                                                                                    cba333af21a6029d9a009d6eb5de608b012b9a57bff78e0404ae188c0cd61d4f6d8c4ae8424554caaac81883693e3d1101a15f745f0d8d5f7f50270f7fd7a3ce

                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    e231aa3a824bc2656dd5c40ff89cf0fa

                                                                                                                                                                    SHA1

                                                                                                                                                                    de77ca52ef1f4b3a1a58d86d10c28c6450337671

                                                                                                                                                                    SHA256

                                                                                                                                                                    c346b0ae9b3b77df71b917d17c5578764becae7b9070420d70fa21daf5f1f2de

                                                                                                                                                                    SHA512

                                                                                                                                                                    9c7ef344681df07ebe2fb8f3674d3e02db50256147773cedc844fe0a13deac70d6c85385256571b461c039a6ca913bceb48d50517e520e32726953b2455484e4

                                                                                                                                                                  • C:\Windows\InstallDir\Server.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    128KB

                                                                                                                                                                    MD5

                                                                                                                                                                    c2888648d79cfbc8ea44e9f20bbd604f

                                                                                                                                                                    SHA1

                                                                                                                                                                    9694449f996a4e30f2eb43b557ed027343b5f25a

                                                                                                                                                                    SHA256

                                                                                                                                                                    27c4833ec00bbc023ea8913fff23fca4f32b507713dbc97e1bbc833b8b0c7631

                                                                                                                                                                    SHA512

                                                                                                                                                                    d987dec835a53845536d118ecf6e8e288167f0ecf88a6002ad3f03b6bb9e898d16f6622109a40d3e0e033bb1b223311979bcd68da95e2a3a7a478d9194328abc

                                                                                                                                                                  • C:\Windows\InstallDir\Server.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    615KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2061cd8e9a166b6503fc2edc9e39f453

                                                                                                                                                                    SHA1

                                                                                                                                                                    75adef444266d9378e1f6da324aa455d467999b1

                                                                                                                                                                    SHA256

                                                                                                                                                                    b3fd18b2a4eb2536e510740ab1b7f829a859ca8a64bb9cc0c642a846d45d54dd

                                                                                                                                                                    SHA512

                                                                                                                                                                    8cc5fd024bb1e5dc941f2cade7b331449464ceba8828608996f40e521ad0c5ee1073c5b93554021f9695aa3867437c0a0a2d0f47126c3e060a1ca5b87e064786

                                                                                                                                                                  • C:\Windows\InstallDir\Server.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    779KB

                                                                                                                                                                    MD5

                                                                                                                                                                    e124bb71f66ce8823770b0d2ad07c9a9

                                                                                                                                                                    SHA1

                                                                                                                                                                    86c93a1007da894d937d9136851dac45f3036604

                                                                                                                                                                    SHA256

                                                                                                                                                                    bf585c924bd41f48b5d370d73fc3c52fa5f3004c2722a918b65446d994e7d1ec

                                                                                                                                                                    SHA512

                                                                                                                                                                    2eb78fac81ae3de7a61b611e7c8240e85b034326a5d4665a60ce49b49d2a72cbcd6428ee0292edb52016d9d2cc31cc9027dced405cee5e8a72930a05dc072fbb

                                                                                                                                                                  • C:\Windows\InstallDir\Server.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    768KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6d0ca1137c55557e9caffeae2bb96404

                                                                                                                                                                    SHA1

                                                                                                                                                                    2b45411801f18a413e96bd41ad7caa70d9f6bfc5

                                                                                                                                                                    SHA256

                                                                                                                                                                    7ed34f24be66eac64c10816f845af3ac7dccd1fdeacb49dde168571cd1716618

                                                                                                                                                                    SHA512

                                                                                                                                                                    4ae504960c31c31232313c497d940478b8bd96c9743649b534c7e71235ba79462645098a882293a1f1db393a6d6272d4932e3530d2f8bda3f1294e9b9e62154e

                                                                                                                                                                  • memory/1252-47-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/1252-46-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1252-40-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1340-157-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/1340-155-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1340-141-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1344-125-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/1612-226-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1620-71-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1620-89-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/1620-87-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/1736-220-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2144-14-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2144-20-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2144-27-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2144-19-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2144-18-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2252-193-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2532-227-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2664-49-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2664-50-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2664-48-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2664-56-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2816-241-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/2816-83-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2816-126-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/2816-85-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/3040-178-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/3040-161-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/3236-7-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/3236-11-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/3236-17-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/3236-16-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/3512-116-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/3512-118-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/3512-110-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/4068-88-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/4068-90-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/4252-249-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/4416-247-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/4568-24-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB

                                                                                                                                                                  • memory/4680-159-0x0000000000400000-0x0000000000422978-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    138KB

                                                                                                                                                                  • memory/4680-158-0x0000000000400000-0x0000000000423000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    140KB

                                                                                                                                                                  • memory/5056-180-0x0000000000C80000-0x0000000000C95000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    84KB