Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/04/2024, 02:58
240410-dgn9kacd46 1010/04/2024, 02:58
240410-dgnm2aff7x 1010/04/2024, 02:58
240410-dgnb9sff7w 1010/04/2024, 02:58
240410-dgm2haff7v 1023/08/2023, 14:58
230823-sb7laaed41 10Analysis
-
max time kernel
1799s -
max time network
1800s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/04/2024, 02:58
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11-20240221-en
General
-
Target
loader.exe
-
Size
401KB
-
MD5
69e3cdc923b668aec4cb405c040565c6
-
SHA1
6a675ebf6f241e543f7bb50ccc8ead462a427880
-
SHA256
8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
-
SHA512
5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
-
SSDEEP
6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
Malware Config
Extracted
gurcu
https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643
Signatures
-
Executes dropped EXE 62 IoCs
pid Process 3660 loader.exe 412 tor.exe 3828 loader.exe 3124 tor.exe 4920 loader.exe 3176 tor.exe 2544 loader.exe 3976 tor.exe 2836 loader.exe 1508 tor.exe 2328 loader.exe 1416 tor.exe 2072 loader.exe 2956 tor.exe 3048 loader.exe 112 tor.exe 3992 loader.exe 2724 tor.exe 5056 loader.exe 3916 tor.exe 1152 loader.exe 1968 tor.exe 1732 loader.exe 1012 tor.exe 1632 loader.exe 3028 tor.exe 1744 loader.exe 352 tor.exe 4608 loader.exe 2424 tor.exe 1972 loader.exe 2284 tor.exe 1556 loader.exe 2276 tor.exe 4684 loader.exe 5104 tor.exe 4828 loader.exe 3356 tor.exe 3408 loader.exe 1220 tor.exe 968 loader.exe 1616 tor.exe 4128 loader.exe 3068 tor.exe 2468 loader.exe 3604 tor.exe 836 loader.exe 4220 tor.exe 1640 loader.exe 4200 tor.exe 4812 loader.exe 240 tor.exe 2028 loader.exe 1380 tor.exe 3004 loader.exe 1652 tor.exe 4100 loader.exe 4984 tor.exe 2052 loader.exe 4216 tor.exe 2908 loader.exe 1508 tor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe Key opened \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1984 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 692 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3660 loader.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 4020 loader.exe Token: SeDebugPrivilege 3660 loader.exe Token: SeDebugPrivilege 3828 loader.exe Token: SeDebugPrivilege 4920 loader.exe Token: SeDebugPrivilege 2544 loader.exe Token: SeDebugPrivilege 2836 loader.exe Token: SeDebugPrivilege 2328 loader.exe Token: SeDebugPrivilege 2072 loader.exe Token: SeDebugPrivilege 3048 loader.exe Token: SeDebugPrivilege 3992 loader.exe Token: SeDebugPrivilege 5056 loader.exe Token: SeDebugPrivilege 1152 loader.exe Token: SeDebugPrivilege 1732 loader.exe Token: SeDebugPrivilege 1632 loader.exe Token: SeDebugPrivilege 1744 loader.exe Token: SeDebugPrivilege 4608 loader.exe Token: SeDebugPrivilege 1972 loader.exe Token: SeDebugPrivilege 1556 loader.exe Token: SeDebugPrivilege 4684 loader.exe Token: SeDebugPrivilege 4828 loader.exe Token: SeDebugPrivilege 3408 loader.exe Token: SeDebugPrivilege 968 loader.exe Token: SeDebugPrivilege 4128 loader.exe Token: SeDebugPrivilege 2468 loader.exe Token: SeDebugPrivilege 836 loader.exe Token: SeDebugPrivilege 1640 loader.exe Token: SeDebugPrivilege 4812 loader.exe Token: SeDebugPrivilege 2028 loader.exe Token: SeDebugPrivilege 3004 loader.exe Token: SeDebugPrivilege 4100 loader.exe Token: SeDebugPrivilege 2052 loader.exe Token: SeDebugPrivilege 2908 loader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4020 wrote to memory of 3440 4020 loader.exe 76 PID 4020 wrote to memory of 3440 4020 loader.exe 76 PID 3440 wrote to memory of 2280 3440 cmd.exe 78 PID 3440 wrote to memory of 2280 3440 cmd.exe 78 PID 3440 wrote to memory of 692 3440 cmd.exe 79 PID 3440 wrote to memory of 692 3440 cmd.exe 79 PID 3440 wrote to memory of 1984 3440 cmd.exe 80 PID 3440 wrote to memory of 1984 3440 cmd.exe 80 PID 3440 wrote to memory of 3660 3440 cmd.exe 81 PID 3440 wrote to memory of 3660 3440 cmd.exe 81 PID 3660 wrote to memory of 4496 3660 loader.exe 82 PID 3660 wrote to memory of 4496 3660 loader.exe 82 PID 3660 wrote to memory of 412 3660 loader.exe 84 PID 3660 wrote to memory of 412 3660 loader.exe 84 PID 3828 wrote to memory of 3124 3828 loader.exe 88 PID 3828 wrote to memory of 3124 3828 loader.exe 88 PID 4920 wrote to memory of 3176 4920 loader.exe 94 PID 4920 wrote to memory of 3176 4920 loader.exe 94 PID 2544 wrote to memory of 3976 2544 loader.exe 99 PID 2544 wrote to memory of 3976 2544 loader.exe 99 PID 2836 wrote to memory of 1508 2836 loader.exe 104 PID 2836 wrote to memory of 1508 2836 loader.exe 104 PID 2328 wrote to memory of 1416 2328 loader.exe 109 PID 2328 wrote to memory of 1416 2328 loader.exe 109 PID 2072 wrote to memory of 2956 2072 loader.exe 114 PID 2072 wrote to memory of 2956 2072 loader.exe 114 PID 3048 wrote to memory of 112 3048 loader.exe 119 PID 3048 wrote to memory of 112 3048 loader.exe 119 PID 3992 wrote to memory of 2724 3992 loader.exe 124 PID 3992 wrote to memory of 2724 3992 loader.exe 124 PID 5056 wrote to memory of 3916 5056 loader.exe 129 PID 5056 wrote to memory of 3916 5056 loader.exe 129 PID 1152 wrote to memory of 1968 1152 loader.exe 134 PID 1152 wrote to memory of 1968 1152 loader.exe 134 PID 1732 wrote to memory of 1012 1732 loader.exe 139 PID 1732 wrote to memory of 1012 1732 loader.exe 139 PID 1632 wrote to memory of 3028 1632 loader.exe 144 PID 1632 wrote to memory of 3028 1632 loader.exe 144 PID 1744 wrote to memory of 352 1744 loader.exe 149 PID 1744 wrote to memory of 352 1744 loader.exe 149 PID 4608 wrote to memory of 2424 4608 loader.exe 154 PID 4608 wrote to memory of 2424 4608 loader.exe 154 PID 1972 wrote to memory of 2284 1972 loader.exe 159 PID 1972 wrote to memory of 2284 1972 loader.exe 159 PID 1556 wrote to memory of 2276 1556 loader.exe 164 PID 1556 wrote to memory of 2276 1556 loader.exe 164 PID 4684 wrote to memory of 5104 4684 loader.exe 169 PID 4684 wrote to memory of 5104 4684 loader.exe 169 PID 4828 wrote to memory of 3356 4828 loader.exe 174 PID 4828 wrote to memory of 3356 4828 loader.exe 174 PID 3408 wrote to memory of 1220 3408 loader.exe 179 PID 3408 wrote to memory of 1220 3408 loader.exe 179 PID 968 wrote to memory of 1616 968 loader.exe 184 PID 968 wrote to memory of 1616 968 loader.exe 184 PID 4128 wrote to memory of 3068 4128 loader.exe 189 PID 4128 wrote to memory of 3068 4128 loader.exe 189 PID 2468 wrote to memory of 3604 2468 loader.exe 194 PID 2468 wrote to memory of 3604 2468 loader.exe 194 PID 836 wrote to memory of 4220 836 loader.exe 199 PID 836 wrote to memory of 4220 836 loader.exe 199 PID 1640 wrote to memory of 4200 1640 loader.exe 204 PID 1640 wrote to memory of 4200 1640 loader.exe 204 PID 4812 wrote to memory of 240 4812 loader.exe 209 PID 4812 wrote to memory of 240 4812 loader.exe 209 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2280
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:692
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1984
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3660 -
C:\Windows\System32\tar.exe"C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp5043.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"4⤵PID:4496
-
-
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"4⤵
- Executes dropped EXE
PID:412
-
-
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3124
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3176
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3976
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1416
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2956
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:112
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2724
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3916
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1012
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:352
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2424
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2284
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:2276
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:5104
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3356
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1220
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1616
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3068
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:3604
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4220
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4200
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:240
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1380
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1652
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4984
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:4216
-
-
C:\Users\Admin\AppData\Local\TeamViewer\loader.exeC:\Users\Admin\AppData\Local\TeamViewer\loader.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe"C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"2⤵
- Executes dropped EXE
PID:1508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847B
MD5486ebddc86ea8b3e965d390d22283a23
SHA1eaffc047f067084867e8575c576a9ec60e094ba8
SHA25650a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d
SHA5120a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d
-
Filesize
401KB
MD569e3cdc923b668aec4cb405c040565c6
SHA16a675ebf6f241e543f7bb50ccc8ead462a427880
SHA2568d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
SHA5125580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
-
Filesize
13.3MB
MD589d2d5811c1aff539bb355f15f3ddad0
SHA15bb3577c25b6d323d927200c48cd184a3e27c873
SHA256b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
SHA51239e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289
-
Filesize
2.6MB
MD58155dd4a16697830a63d507d2666b2a9
SHA1e07a54b15c905cd1d9d41db3ccde3bade36bcdb4
SHA2566b4f443629c32b632d8ad7bcb17d84da1e4eaec556dccdf98c5e9051cb404fed
SHA5120cb6c3fa12cbe7f8e63c5c73c0665fc2593109801ba318c582c4bd1c14dfd27fff3252c22b9078040e743ec788ad9534856c72ca5e38d992d9cb5aeacf819e6f
-
Filesize
12.0MB
MD52f072b3e3cc53e919b36f5923cde912e
SHA197f2ec6a7800612af21ad58f9ad13bb920656dc3
SHA256bd57bc516848c829b0585b422e456782d6d6022aaeae1725fa309f2d1fcf136e
SHA51252a62b15a81ae97f2643f9ac2f47f7859d27dbe521ccec4925e84f1feeff2e6ea29ed708c5724c5c9b822fdf2d02429bcbe52acadc0222ddd797b8a343aa670d
-
Filesize
64B
MD5a94316fc1ecd2569cb410e90226ea856
SHA141b607033167d0cb13ce76e0bd3b9b652f95d705
SHA256116ee44e37d3aa478bfc11acf8694ae67eddee90e905a1b9089c1abce2ac045e
SHA512f65181e9c88a3b252125d0b8f2ac38a71adfcc6e80f21c93fd60615ffa3467bb8257bfe77c4582282cbfec202fa7f7a158a677f0b7952a533ce506754b5a90fa
-
Filesize
4B
MD5c5bbd980e5ab2c17413ec02bd757a9e5
SHA1b9c1d2de39fe832a29a1d22c32b7edfda6e1ce81
SHA256115c08a62490bff35d2499453b1d120c023212ac1bd3a477d585155bdb2d2b81
SHA512d806ba436694880c604e417bc2941b7d52ef36bf59b5a1f68b452913c39aa142bd99080f91d999fd53c666346759a3ab5685a9c1a28e15dcbed514c90512e811
-
Filesize
7.4MB
MD588590909765350c0d70c6c34b1f31dd2
SHA1129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA25646fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
SHA512a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
-
Filesize
218B
MD5797c4d3d526a55de6e257a9afdf5bcd7
SHA1aa7717384b0736733ce4d1f3b1c1901616490d97
SHA25672534f56125ccd86672b4f34f8e621cfeaa89cda6e5fdcf2bf2a26b582dc09ac
SHA5123e922f7478908e47fda73917c1091c40ff9901c03193626b21c51760766f90df8696304253a350ac6078e8a4e5e5fb53b0da609a28019745aa865ed5a55bd185