Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

m1f1f3a069...5d.exe

windows7-x64

10

m1f1f3a069...5d.exe

windows10-1703-x64

10

m1f1f3a069...5d.exe

windows10-2004-x64

10

m1f1f3a069...5d.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:28

240410-cyaxtsca43 10

10/04/2024, 02:28

240410-cx45aaca36 10

10/04/2024, 02:28

240410-cx4hrafc61 10

10/04/2024, 02:28

240410-cx37zsfc6y 10

14/10/2023, 01:16

231014-bm3ysshd6t 10

Analysis

  • max time kernel
    1797s
  • max time network
    1806s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/04/2024, 02:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    m1f1f3a069223072f8d6802a079235d.exe

  • Size

    306KB

  • MD5

    4b36dcaa94c3eca48a6292bd670ffe79

  • SHA1

    705484e61ac39ba02cc80903be0da6ce74333334

  • SHA256

    c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9

  • SHA512

    cf07d7f80264554eb3b945421ca41db38ff79707775d355d478c09f4b64d14f523339295aa4bc9b79c0dbb004e6756585bcf85edc8cbc2d16f7f0481be93513a

  • SSDEEP

    3072:71E/yXS0m2pOVLVewP2D/kIyC+mvXi1QJIkjXAToknBq9tT/8RJ6W3t3dpdQGqKI:7E2mDMtqa5EOTeKXAllKD9bmTneefA

Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6209822134:AAHQxD-CI1YDVcNbXijXHlonsEUgv3dfYtg/sendMessage?chat_id=-1001529292045

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe
    "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:728
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1584
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1856
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1460
        • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:2428
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp8A10.tmp" -C "C:\Users\Admin\AppData\Local\d67800nkmj"
            4⤵
              PID:4544
            • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
              "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:5072
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2512
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3184
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3832
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3436
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3184
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1028
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3232
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2360
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2500
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1604
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2212
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2744
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4308
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3384
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4620
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3212
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4676
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4996
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4668
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1604
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3964
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3292
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3420
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2752
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3768
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4704
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3736
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4508
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1948
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3408
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3156
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:652
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3764
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4260
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1544
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2664
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4184
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\m1f1f3a069223072f8d6802a079235d.exe.log
        Filesize

        847B

        MD5

        486ebddc86ea8b3e965d390d22283a23

        SHA1

        eaffc047f067084867e8575c576a9ec60e094ba8

        SHA256

        50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d

        SHA512

        0a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d

        Download Submit

      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        Filesize

        306KB

        MD5

        4b36dcaa94c3eca48a6292bd670ffe79

        SHA1

        705484e61ac39ba02cc80903be0da6ce74333334

        SHA256

        c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9

        SHA512

        cf07d7f80264554eb3b945421ca41db38ff79707775d355d478c09f4b64d14f523339295aa4bc9b79c0dbb004e6756585bcf85edc8cbc2d16f7f0481be93513a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp8A10.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdesc-consensus
        Filesize

        2.7MB

        MD5

        a0db8a87f7b723266c8b04255da46b06

        SHA1

        4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

        SHA256

        60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

        SHA512

        41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdescs.new
        Filesize

        13.5MB

        MD5

        12cada02e959383e75887aebfa44086f

        SHA1

        23d534a381fc35ce2c1a924159e2ff5324b169aa

        SHA256

        53e66054c63c96a5eb4af6b18d06847690a3fa14c69cfaf4fd7b3e0e71384dfb

        SHA512

        66f3378d192142777a4f5740e392c497dd89d5521a669eeb46cd4777dceb19ba071129062bf0206e6d936d31bfd25d344d75bdd4c20ca447542c7a3c986c289b

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\host\hostname
        Filesize

        64B

        MD5

        5175ff7a6d13d0680439acab30b0dde3

        SHA1

        5105a55942dede5d5b1949431e45eeb47a4ed82f

        SHA256

        4e4f01225bc1329dcbe53e3180ea3663e656157e29406f9e171c93b301266bff

        SHA512

        b7b803029eafea5acdff97ee98bd8386d31f18b0fe11f187f40a1e5aab4c53f6dfce7458b9ad6322af1104d11677bc267d8b6d8682d9926ee6269cf225372209

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\port.dat
        Filesize

        4B

        MD5

        1f6419b1cbe79c71410cb320fc094775

        SHA1

        66aa1cb9a469f74f6057878a4dcaaf9dbabd9529

        SHA256

        a994696540befd55c96017a162c7ae2685f2010a7fd3224c0ada25241913933b

        SHA512

        4f2b22c6793707a59024a47a837d618bc9ef174869a8157ddff6ff765d917cb23fc406e753c172065fafb8b47c39ba399690a5caa059730f88c6ec81c2967288

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt
        Filesize

        218B

        MD5

        687b70bc95c50b97a30d4ec95da05f55

        SHA1

        aca0b631a58aba2ec50b6c2ab8a7d59a2f2bfe53

        SHA256

        1302654e3371abdc365abb36daa174c9267d3281f633159aad3a0115970c9f4d

        SHA512

        5b1fdb1b755e3c1562287f4a91c757362110a0534f290a5e828617ffade63ecae2090fc0c5fe8a8afb3691ae096765c599f4653c3b7e95e9fccc76812fcea512

        Download Submit

      • memory/388-321-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/388-322-0x00000297C0B30000-0x00000297C0B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/388-324-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1408-108-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1408-110-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1592-203-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1592-201-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1860-272-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1860-269-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1860-270-0x0000023571860000-0x0000023571870000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1952-305-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1952-303-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2124-97-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2124-98-0x0000028AE38D0000-0x0000028AE38E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2124-100-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2212-233-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2212-235-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2428-12-0x0000022812D10000-0x0000022812D20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2428-11-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2428-40-0x000002282CC70000-0x000002282CE23000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2428-66-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2428-67-0x0000022812D10000-0x0000022812D20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2616-285-0x00000224ADA70000-0x00000224ADA80000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2616-284-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2616-287-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2872-1-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2872-6-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2872-0-0x000001DA53D40000-0x000001DA53D92000-memory.dmp

        Filesize

        328KB

        Download

      • memory/2872-4-0x000001DA6E570000-0x000001DA6E580000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2984-122-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2984-124-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3292-395-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3292-396-0x000001A7B1B80000-0x000001A7B1B90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3292-398-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3660-470-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3696-383-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3696-381-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3768-435-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3768-433-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3956-185-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3956-182-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3956-183-0x0000020BC0990000-0x0000020BC09A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4416-78-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4416-81-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4548-253-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4548-251-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4592-451-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4592-454-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4592-452-0x000001DB59730000-0x000001DB59740000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4724-359-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4724-361-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4804-417-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4804-414-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4804-415-0x000002E6F16E0000-0x000002E6F16F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4912-138-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4912-136-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4960-168-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4960-170-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4996-341-0x0000028476D20000-0x0000028476D30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4996-343-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4996-340-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5052-156-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5052-154-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5068-221-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5068-219-0x00007FFD83AF0000-0x00007FFD845B2000-memory.dmp

        Filesize

        10.8MB

        Download