Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/04/2024, 02:58
240410-dgn9kacd46 1010/04/2024, 02:58
240410-dgnm2aff7x 1010/04/2024, 02:58
240410-dgnb9sff7w 1010/04/2024, 02:58
240410-dgm2haff7v 1023/08/2023, 14:58
230823-sb7laaed41 10Analysis
-
max time kernel
1798s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 02:58
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11-20240221-en
General
-
Target
loader.exe
-
Size
401KB
-
MD5
69e3cdc923b668aec4cb405c040565c6
-
SHA1
6a675ebf6f241e543f7bb50ccc8ead462a427880
-
SHA256
8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
-
SHA512
5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
-
SSDEEP
6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
Malware Config
Extracted
gurcu
https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643
Signatures
-
Checks computer location settings 2 TTPs 32 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation loader.exe -
Executes dropped EXE 62 IoCs
pid Process 4216 loader.exe 4468 tor.exe 1316 loader.exe 1568 tor.exe 3032 loader.exe 4416 tor.exe 3564 loader.exe 3720 tor.exe 5068 loader.exe 668 tor.exe 2420 loader.exe 2004 tor.exe 1348 loader.exe 1352 tor.exe 2912 loader.exe 1612 tor.exe 3912 loader.exe 5020 tor.exe 3148 loader.exe 4636 tor.exe 5100 loader.exe 3124 tor.exe 1520 loader.exe 872 tor.exe 880 loader.exe 1816 tor.exe 2416 loader.exe 4316 tor.exe 4832 loader.exe 1988 tor.exe 4368 loader.exe 1276 tor.exe 3668 loader.exe 760 tor.exe 3984 loader.exe 456 tor.exe 4988 loader.exe 4044 tor.exe 1572 loader.exe 2416 tor.exe 2956 loader.exe 4372 tor.exe 3524 loader.exe 3348 tor.exe 3272 loader.exe 1432 tor.exe 4976 loader.exe 4328 tor.exe 2176 loader.exe 4212 tor.exe 1520 loader.exe 1420 tor.exe 5052 loader.exe 5068 tor.exe 316 loader.exe 2068 tor.exe 4044 loader.exe 4292 tor.exe 532 loader.exe 4652 tor.exe 4940 loader.exe 4324 tor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 87 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 436 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1736 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4216 loader.exe 4216 loader.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 228 loader.exe Token: SeDebugPrivilege 4216 loader.exe Token: SeDebugPrivilege 1316 loader.exe Token: SeDebugPrivilege 3032 loader.exe Token: SeDebugPrivilege 3564 loader.exe Token: SeDebugPrivilege 5068 loader.exe Token: SeDebugPrivilege 2420 loader.exe Token: SeDebugPrivilege 1348 loader.exe Token: SeDebugPrivilege 2912 loader.exe Token: SeDebugPrivilege 3912 loader.exe Token: SeManageVolumePrivilege 956 svchost.exe Token: SeDebugPrivilege 3148 loader.exe Token: SeDebugPrivilege 5100 loader.exe Token: SeDebugPrivilege 1520 loader.exe Token: SeDebugPrivilege 880 loader.exe Token: SeDebugPrivilege 2416 loader.exe Token: SeDebugPrivilege 4832 loader.exe Token: SeDebugPrivilege 4368 loader.exe Token: SeDebugPrivilege 3668 loader.exe Token: SeDebugPrivilege 3984 loader.exe Token: SeDebugPrivilege 4988 loader.exe Token: SeDebugPrivilege 1572 loader.exe Token: SeDebugPrivilege 2956 loader.exe Token: SeDebugPrivilege 3524 loader.exe Token: SeDebugPrivilege 3272 loader.exe Token: SeDebugPrivilege 4976 loader.exe Token: SeDebugPrivilege 2176 loader.exe Token: SeDebugPrivilege 1520 loader.exe Token: SeDebugPrivilege 5052 loader.exe Token: SeDebugPrivilege 316 loader.exe Token: SeDebugPrivilege 4044 loader.exe Token: SeDebugPrivilege 532 loader.exe Token: SeDebugPrivilege 4940 loader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 4752 228 loader.exe 86 PID 228 wrote to memory of 4752 228 loader.exe 86 PID 4752 wrote to memory of 1372 4752 cmd.exe 88 PID 4752 wrote to memory of 1372 4752 cmd.exe 88 PID 4752 wrote to memory of 1736 4752 cmd.exe 89 PID 4752 wrote to memory of 1736 4752 cmd.exe 89 PID 4752 wrote to memory of 436 4752 cmd.exe 97 PID 4752 wrote to memory of 436 4752 cmd.exe 97 PID 4752 wrote to memory of 4216 4752 cmd.exe 98 PID 4752 wrote to memory of 4216 4752 cmd.exe 98 PID 4216 wrote to memory of 4556 4216 loader.exe 100 PID 4216 wrote to memory of 4556 4216 loader.exe 100 PID 4216 wrote to memory of 4468 4216 loader.exe 102 PID 4216 wrote to memory of 4468 4216 loader.exe 102 PID 1316 wrote to memory of 1568 1316 loader.exe 108 PID 1316 wrote to memory of 1568 1316 loader.exe 108 PID 3032 wrote to memory of 4416 3032 loader.exe 114 PID 3032 wrote to memory of 4416 3032 loader.exe 114 PID 3564 wrote to memory of 3720 3564 loader.exe 119 PID 3564 wrote to memory of 3720 3564 loader.exe 119 PID 5068 wrote to memory of 668 5068 loader.exe 124 PID 5068 wrote to memory of 668 5068 loader.exe 124 PID 2420 wrote to memory of 2004 2420 loader.exe 129 PID 2420 wrote to memory of 2004 2420 loader.exe 129 PID 1348 wrote to memory of 1352 1348 loader.exe 134 PID 1348 wrote to memory of 1352 1348 loader.exe 134 PID 2912 wrote to memory of 1612 2912 loader.exe 139 PID 2912 wrote to memory of 1612 2912 loader.exe 139 PID 3912 wrote to memory of 5020 3912 loader.exe 151 PID 3912 wrote to memory of 5020 3912 loader.exe 151 PID 3148 wrote to memory of 4636 3148 loader.exe 162 PID 3148 wrote to memory of 4636 3148 loader.exe 162 PID 5100 wrote to memory of 3124 5100 loader.exe 169 PID 5100 wrote to memory of 3124 5100 loader.exe 169 PID 1520 wrote to memory of 872 1520 loader.exe 174 PID 1520 wrote to memory of 872 1520 loader.exe 174 PID 880 wrote to memory of 1816 880 loader.exe 179 PID 880 wrote to memory of 1816 880 loader.exe 179 PID 2416 wrote to memory of 4316 2416 loader.exe 184 PID 2416 wrote to memory of 4316 2416 loader.exe 184 PID 4832 wrote to memory of 1988 4832 loader.exe 189 PID 4832 wrote to memory of 1988 4832 loader.exe 189 PID 4368 wrote to memory of 1276 4368 loader.exe 194 PID 4368 wrote to memory of 1276 4368 loader.exe 194 PID 3668 wrote to memory of 760 3668 loader.exe 199 PID 3668 wrote to memory of 760 3668 loader.exe 199 PID 3984 wrote to memory of 456 3984 loader.exe 204 PID 3984 wrote to memory of 456 3984 loader.exe 204 PID 4988 wrote to memory of 4044 4988 loader.exe 209 PID 4988 wrote to memory of 4044 4988 loader.exe 209 PID 1572 wrote to memory of 2416 1572 loader.exe 214 PID 1572 wrote to memory of 2416 1572 loader.exe 214 PID 2956 wrote to memory of 4372 2956 loader.exe 219 PID 2956 wrote to memory of 4372 2956 loader.exe 219 PID 3524 wrote to memory of 3348 3524 loader.exe 224 PID 3524 wrote to memory of 3348 3524 loader.exe 224 PID 3272 wrote to memory of 1432 3272 loader.exe 229 PID 3272 wrote to memory of 1432 3272 loader.exe 229 PID 4976 wrote to memory of 4328 4976 loader.exe 234 PID 4976 wrote to memory of 4328 4976 loader.exe 234 PID 2176 wrote to memory of 4212 2176 loader.exe 239 PID 2176 wrote to memory of 4212 2176 loader.exe 239 PID 1520 wrote to memory of 1420 1520 loader.exe 244 PID 1520 wrote to memory of 1420 1520 loader.exe 244 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1372
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1736
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:436
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4216 -
C:\Windows\System32\tar.exe"C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp5DA1.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"4⤵PID:4556
-
-
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"4⤵
- Executes dropped EXE
PID:4468
-
-
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1568
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4416
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3720
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:668
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2004
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1352
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:5020
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4884
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:956
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4636
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3124
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:872
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4316
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1988
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1276
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:760
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:456
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4044
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2416
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4372
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3348
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1432
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4328
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4212
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1420
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:5068
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2068
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4044 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4292
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4652
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4940 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847B
MD53308a84a40841fab7dfec198b3c31af7
SHA14e7ab6336c0538be5dd7da529c0265b3b6523083
SHA256169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
SHA51297521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198
-
Filesize
401KB
MD569e3cdc923b668aec4cb405c040565c6
SHA16a675ebf6f241e543f7bb50ccc8ead462a427880
SHA2568d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
SHA5125580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
-
Filesize
13.3MB
MD589d2d5811c1aff539bb355f15f3ddad0
SHA15bb3577c25b6d323d927200c48cd184a3e27c873
SHA256b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
SHA51239e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289
-
Filesize
2.6MB
MD58155dd4a16697830a63d507d2666b2a9
SHA1e07a54b15c905cd1d9d41db3ccde3bade36bcdb4
SHA2566b4f443629c32b632d8ad7bcb17d84da1e4eaec556dccdf98c5e9051cb404fed
SHA5120cb6c3fa12cbe7f8e63c5c73c0665fc2593109801ba318c582c4bd1c14dfd27fff3252c22b9078040e743ec788ad9534856c72ca5e38d992d9cb5aeacf819e6f
-
Filesize
14.2MB
MD5674c2c00c16ada4c58be9dd1c7aaf193
SHA1984b63fb7ae3458002c054f531800c72696d5c8b
SHA25664692c80bb0ed0de40e961e286f5356b27eec6400bc6a96db717c6da96f6f07f
SHA5126f98149bfb3d112c9a40f23a4002a6e76b7cdf6a417ee4d8a9a15068df636a59cc9fb9b875719792183d1f88c5fe689a261bd6f82a6bad420c336c6019da271c
-
Filesize
64B
MD5e3227c8f19e8a9e3f2408070cd81886f
SHA10ef3079e0ca2f198c0b7fcc529bcb64d26a4c893
SHA256ef3cd441a57225ba8121179a37da1aa415166699bd181b6192353843e5f992ae
SHA51264037e8ccc5ee2457a804fe7f9f8e9c232c81011b10b47ac1577e856aa2e7595fae3ca90eba4bc9dc4c8302323ec7124f843198958331090e311af9ca5bcf490
-
Filesize
4B
MD5b5c24ab1ddc1aecd658a6cd39eb2362d
SHA1a980942f60e0dc3c0819001b6ce7fcf42942943f
SHA256121076a4131f0eb802fd9f9c68c6aa8aafbe66ce76d85c9635a3403cf1016dca
SHA512c34b65c2f06eeafdeb67412d238e7fe51659da1f16d93c179cbfd4c9a568f53ebb25dc499364e4625ed4f17d4a6620e1c24da53d77edcc72d1ecf517276c08f8
-
Filesize
7.4MB
MD588590909765350c0d70c6c34b1f31dd2
SHA1129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA25646fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
SHA512a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
-
Filesize
218B
MD5231c262cc90aab080d10ce2def01fe72
SHA15cafeedd6565e27da85a7b4b29140dfa525d2cfd
SHA256f1754bff233448f9596e7928ed18b4fb40f3caaa6b505fddf15c0dd96185f808
SHA512d53a4d1e6a9907d1459fcec101c52b14c05e75f734c6b283c93d2d27e327f695bd286ba1162cf36ca2cd9bea06bcc6ed839a3af511a818202d639ef9a1020fe9