Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/04/2024, 02:58

240410-dgn9kacd46 10

10/04/2024, 02:58

240410-dgnm2aff7x 10

10/04/2024, 02:58

240410-dgnb9sff7w 10

10/04/2024, 02:58

240410-dgm2haff7v 10

23/08/2023, 14:58

230823-sb7laaed41 10

Analysis

  • max time kernel
    1798s
  • max time network
    1801s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:58

General

  • Target

    loader.exe

  • Size

    401KB

  • MD5

    69e3cdc923b668aec4cb405c040565c6

  • SHA1

    6a675ebf6f241e543f7bb50ccc8ead462a427880

  • SHA256

    8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

  • SHA512

    5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb

  • SSDEEP

    6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • Checks computer location settings 2 TTPs 32 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1372
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1736
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:436
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4216
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp5DA1.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"
            4⤵
              PID:4556
            • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
              "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:4468
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1568
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4416
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3564
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3720
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:668
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2004
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1352
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1612
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:5020
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4884
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:956
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3148
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4636
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3124
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:872
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:880
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1816
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4316
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4832
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1988
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4368
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1276
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3668
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:760
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3984
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:456
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4044
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1572
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2416
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4372
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3524
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3348
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1432
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4328
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4212
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1420
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5052
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:5068
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:316
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2068
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4044
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4292
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:532
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4652
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4940
          • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
            "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4324

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log

          Filesize

          847B

          MD5

          3308a84a40841fab7dfec198b3c31af7

          SHA1

          4e7ab6336c0538be5dd7da529c0265b3b6523083

          SHA256

          169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

          SHA512

          97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe

          Filesize

          401KB

          MD5

          69e3cdc923b668aec4cb405c040565c6

          SHA1

          6a675ebf6f241e543f7bb50ccc8ead462a427880

          SHA256

          8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

          SHA512

          5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb

        • C:\Users\Admin\AppData\Local\Temp\tmp5DA1.tmp

          Filesize

          13.3MB

          MD5

          89d2d5811c1aff539bb355f15f3ddad0

          SHA1

          5bb3577c25b6d323d927200c48cd184a3e27c873

          SHA256

          b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

          SHA512

          39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdesc-consensus.tmp

          Filesize

          2.6MB

          MD5

          8155dd4a16697830a63d507d2666b2a9

          SHA1

          e07a54b15c905cd1d9d41db3ccde3bade36bcdb4

          SHA256

          6b4f443629c32b632d8ad7bcb17d84da1e4eaec556dccdf98c5e9051cb404fed

          SHA512

          0cb6c3fa12cbe7f8e63c5c73c0665fc2593109801ba318c582c4bd1c14dfd27fff3252c22b9078040e743ec788ad9534856c72ca5e38d992d9cb5aeacf819e6f

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdescs.new

          Filesize

          14.2MB

          MD5

          674c2c00c16ada4c58be9dd1c7aaf193

          SHA1

          984b63fb7ae3458002c054f531800c72696d5c8b

          SHA256

          64692c80bb0ed0de40e961e286f5356b27eec6400bc6a96db717c6da96f6f07f

          SHA512

          6f98149bfb3d112c9a40f23a4002a6e76b7cdf6a417ee4d8a9a15068df636a59cc9fb9b875719792183d1f88c5fe689a261bd6f82a6bad420c336c6019da271c

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\host\hostname

          Filesize

          64B

          MD5

          e3227c8f19e8a9e3f2408070cd81886f

          SHA1

          0ef3079e0ca2f198c0b7fcc529bcb64d26a4c893

          SHA256

          ef3cd441a57225ba8121179a37da1aa415166699bd181b6192353843e5f992ae

          SHA512

          64037e8ccc5ee2457a804fe7f9f8e9c232c81011b10b47ac1577e856aa2e7595fae3ca90eba4bc9dc4c8302323ec7124f843198958331090e311af9ca5bcf490

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\port.dat

          Filesize

          4B

          MD5

          b5c24ab1ddc1aecd658a6cd39eb2362d

          SHA1

          a980942f60e0dc3c0819001b6ce7fcf42942943f

          SHA256

          121076a4131f0eb802fd9f9c68c6aa8aafbe66ce76d85c9635a3403cf1016dca

          SHA512

          c34b65c2f06eeafdeb67412d238e7fe51659da1f16d93c179cbfd4c9a568f53ebb25dc499364e4625ed4f17d4a6620e1c24da53d77edcc72d1ecf517276c08f8

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe

          Filesize

          7.4MB

          MD5

          88590909765350c0d70c6c34b1f31dd2

          SHA1

          129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

          SHA256

          46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

          SHA512

          a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt

          Filesize

          218B

          MD5

          231c262cc90aab080d10ce2def01fe72

          SHA1

          5cafeedd6565e27da85a7b4b29140dfa525d2cfd

          SHA256

          f1754bff233448f9596e7928ed18b4fb40f3caaa6b505fddf15c0dd96185f808

          SHA512

          d53a4d1e6a9907d1459fcec101c52b14c05e75f734c6b283c93d2d27e327f695bd286ba1162cf36ca2cd9bea06bcc6ed839a3af511a818202d639ef9a1020fe9

        • memory/228-6-0x00007FFB4F370000-0x00007FFB4FE31000-memory.dmp

          Filesize

          10.8MB

        • memory/228-0-0x0000011D361E0000-0x0000011D36248000-memory.dmp

          Filesize

          416KB

        • memory/228-4-0x0000011D50630000-0x0000011D50640000-memory.dmp

          Filesize

          64KB

        • memory/228-1-0x00007FFB4F370000-0x00007FFB4FE31000-memory.dmp

          Filesize

          10.8MB

        • memory/880-238-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/880-232-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/956-160-0x0000022528980000-0x0000022528990000-memory.dmp

          Filesize

          64KB

        • memory/956-194-0x0000022530E20000-0x0000022530E21000-memory.dmp

          Filesize

          4KB

        • memory/956-196-0x0000022530F30000-0x0000022530F31000-memory.dmp

          Filesize

          4KB

        • memory/956-195-0x0000022530E20000-0x0000022530E21000-memory.dmp

          Filesize

          4KB

        • memory/956-176-0x0000022528A80000-0x0000022528A90000-memory.dmp

          Filesize

          64KB

        • memory/956-192-0x0000022530DF0000-0x0000022530DF1000-memory.dmp

          Filesize

          4KB

        • memory/1316-79-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1316-86-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1348-135-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1348-133-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1520-390-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1520-220-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1520-222-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1520-392-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1572-316-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/1572-318-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2176-378-0x0000021A470D0000-0x0000021A470E0000-memory.dmp

          Filesize

          64KB

        • memory/2176-377-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2176-380-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2416-244-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2416-246-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2420-123-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2420-121-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2912-143-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2912-141-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2956-328-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/2956-330-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3032-92-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3032-94-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3148-205-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3148-203-0x00000291A8AE0000-0x00000291A8AF0000-memory.dmp

          Filesize

          64KB

        • memory/3148-202-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3272-353-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3272-355-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3524-347-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3524-345-0x0000023F63DF0000-0x0000023F63E00000-memory.dmp

          Filesize

          64KB

        • memory/3524-344-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3564-104-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3564-106-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3668-284-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3668-286-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3912-153-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3912-155-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3984-292-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/3984-294-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4216-12-0x0000020634AE0000-0x0000020634AF0000-memory.dmp

          Filesize

          64KB

        • memory/4216-61-0x0000020634AE0000-0x0000020634AF0000-memory.dmp

          Filesize

          64KB

        • memory/4216-59-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4216-11-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4368-272-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4368-274-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4832-258-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4832-256-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4976-365-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4976-367-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4988-310-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/4988-308-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5052-398-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5052-404-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5068-108-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5068-109-0x0000021FCA230000-0x0000021FCA240000-memory.dmp

          Filesize

          64KB

        • memory/5068-111-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5100-212-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB

        • memory/5100-214-0x00007FFB4E190000-0x00007FFB4EC51000-memory.dmp

          Filesize

          10.8MB