Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 09:30

General

  • Target

    ed1a3abc98efb0c062eb2032acba88d8_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    ed1a3abc98efb0c062eb2032acba88d8

  • SHA1

    e3f9347ce39492ae6ec319e830b5a416a572a870

  • SHA256

    7284d31b1bd8491726f4845a77d96bc7b9ed9c8c00b4b9969f05c16d667078a6

  • SHA512

    25c35d2f501a8228d12e8f0cbe896df9b50f1f95341f2095b6e362e0c0e23d19356fca701505ad0d5c5866783d8ef1ea03e5c94172f6161194bd222160be8603

  • SSDEEP

    3072:ngK+oF6OfsAErOjDdxItf8ZcPrw6dDfbBDEA8sP1mNlPvpFA:ngjoxNEr8dOtf88T+BNlPvpF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 61 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed1a3abc98efb0c062eb2032acba88d8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed1a3abc98efb0c062eb2032acba88d8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-34903.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2800
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-33061.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2268
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2328
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1496
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
                      10⤵
                      • Executes dropped EXE
                      PID:336
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-48647.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-48647.exe
                        11⤵
                          PID:1656
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
                            12⤵
                              PID:2560
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
                            11⤵
                              PID:1088
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2668
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50776.exe
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1916
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
                            10⤵
                              PID:856
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1768
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-57944.exe
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1712
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-61283.exe
                            9⤵
                              PID:2452
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
                                10⤵
                                  PID:544
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
                                9⤵
                                  PID:2444
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1056
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-4446.exe
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2308
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2624
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
                                  9⤵
                                    PID:2180
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
                                      10⤵
                                        PID:596
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-56291.exe
                                          11⤵
                                            PID:1616
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
                                        9⤵
                                          PID:1932
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-26158.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1132
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1960
                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2572
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1480
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
                                          9⤵
                                          • Executes dropped EXE
                                          PID:580
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
                                            10⤵
                                              PID:2396
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
                                                11⤵
                                                  PID:2984
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2376
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
                                            8⤵
                                              PID:1924
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
                                                9⤵
                                                  PID:1956
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 240
                                                    10⤵
                                                    • Program crash
                                                    PID:1564
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2636
                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-55878.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:2868
                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1724
                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:688
                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2416
                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
                                                8⤵
                                                  PID:2440
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-45497.exe
                                                    9⤵
                                                      PID:2432
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
                                                    8⤵
                                                      PID:1000
                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-42681.exe
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2428
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-55659.exe
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:2848
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-40287.exe
                                                      8⤵
                                                        PID:1804
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
                                                          9⤵
                                                            PID:2040
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
                                                          8⤵
                                                            PID:440
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:952
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2860
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-40178.exe
                                                          7⤵
                                                            PID:1540
                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2580
                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:528
                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51260.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2916
                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2188
                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11291.exe
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:268
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
                                                              8⤵
                                                              • Executes dropped EXE
                                                              PID:2464
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-45715.exe
                                                                9⤵
                                                                  PID:2616
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-49581.exe
                                                                    10⤵
                                                                      PID:2472
                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1096
                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-46791.exe
                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-46791.exe
                                                                7⤵
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2792
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-52923.exe
                                                                  8⤵
                                                                    PID:2544
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-40453.exe
                                                                      9⤵
                                                                        PID:2164
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
                                                                      8⤵
                                                                        PID:888
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-59765.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2372
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-11867.exe
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2568
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
                                                                      7⤵
                                                                        PID:2384
                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
                                                                          8⤵
                                                                            PID:2564
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:544
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:280
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2612
                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-44454.exe
                                                                          7⤵
                                                                            PID:1636
                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-34886.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2616
                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2436
                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1180
                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2764
                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1664
                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-59807.exe
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1204
                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
                                                                              8⤵
                                                                                PID:1700
                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2816
                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:1556
                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
                                                                                8⤵
                                                                                  PID:2576
                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1084
                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
                                                                              6⤵
                                                                                PID:2112
                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-42302.exe
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1632
                                                                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Unicorn-14093.exe
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1952
                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2804
                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-48346.exe
                                                                                  7⤵
                                                                                    PID:2068
                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:872
                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-23183.exe
                                                                                  6⤵
                                                                                    PID:688
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
                                                                                      7⤵
                                                                                        PID:2392
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
                                                                                      6⤵
                                                                                        PID:1812
                                                                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-14845.exe
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1884
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1772
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:692
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2576
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-39624.exe
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2608
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
                                                                                            8⤵
                                                                                              PID:824
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
                                                                                                9⤵
                                                                                                  PID:640
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1784
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1656
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2776
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\Unicorn-44262.exe
                                                                                            6⤵
                                                                                              PID:2160

                                                                                  Network

                                                                                  MITRE ATT&CK Matrix

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    8afbf8c1dde79f9e7e9a946d54bfe927

                                                                                    SHA1

                                                                                    3cea75f69080d512d521d23b4a163eb4eab08823

                                                                                    SHA256

                                                                                    1dd861933ab0cf2b876a3d756bf1b7d3cd90d5ee48458f7c2a1de4990458e1f9

                                                                                    SHA512

                                                                                    5bd6eac94a3f0e3fc70837fbc4125062431fa2cfa099f4bad35a34cb6542a675c9b3ab1776c6f9da77b59a0ce9c481d4b3e9e92590d71a3ee790657fca9975cc

                                                                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    aa15ffb6d5f835e9d297b7930ff3abc9

                                                                                    SHA1

                                                                                    ce863d8960bf91dfe7c3046a743eed284635b352

                                                                                    SHA256

                                                                                    278f17eece237ea6c2e16a11929358061dcdbb2d7557f57a4347898eb1dbf459

                                                                                    SHA512

                                                                                    9d58a25835a38ed60c4bd1da30e084b76ef8db14ddfb95e2c6d48f207c09c64adc5d41f35d262b23af881d05baec9b22813877cd2a68bf9f882efe640a47a1d3

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-13849.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    1fc127e521ca49ff4448d51ef98dfbdd

                                                                                    SHA1

                                                                                    22ec4fe14e9ed08a4255ca767454461a4c785e27

                                                                                    SHA256

                                                                                    1bc09b7219bba732ffb4a2995dfbd8d31a6e5495e53f442b0b0a8f3cd6c1cebe

                                                                                    SHA512

                                                                                    ddefe6c08883be81fd7cb43322134ea5a6bb81f30bbe7b8a107de8f055e48b4f741f5c250aef4565f11366eea890180b4a1cf0877b57e42cb0db416f5f0a947e

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-14845.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    c0b237fd69ab8a5296bcdcdcf71e0fd1

                                                                                    SHA1

                                                                                    fd70f35e79211376b3aebac32caafbd5bd3fe1bd

                                                                                    SHA256

                                                                                    86c650864e1a5ef31218d115b8b30872c205e5cdafd7eac6a76ba3907c4d9ffe

                                                                                    SHA512

                                                                                    e942e88acc2fdc1427517b774c0c3274979d9440b9e48c48316655d15a023019b76a13f46716b40e758b9e5d62faf9a3075286f1cd771dc9ed87c264e59ea75a

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-22205.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    35563f0a5ea929f3750d6c770792304e

                                                                                    SHA1

                                                                                    cf986f5d9c18e434122881fe2cbeedb3bf058f2e

                                                                                    SHA256

                                                                                    e6f6f6543cdb1681c58d3e3d479189fa0df6e232960d14534a07e2f349771b2b

                                                                                    SHA512

                                                                                    22bbebf9af1bc830ea90c99bb08a2076cfa8dfe2c3f097caeae082d1f18619ec99ec31f2b0ae340a8b5ef8fa2b431c2d65c2821993406f7ed2ff3269ab610674

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-25796.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    c967c3bc91ddb7471dc4c6d7e9744587

                                                                                    SHA1

                                                                                    26cab47fb644be603356eeb2a8c3a6009db45634

                                                                                    SHA256

                                                                                    6499e2171f3b3797001af8f0a3f39dad286f0bb756d4fc00228982e8351f63a9

                                                                                    SHA512

                                                                                    250a137c143ab247eb31f5876ef6c85301b6d2785268bf86366949e08f252afc5e09130afd97602d5860b0d8d65e0fb17a007daea684d040a48f7120bcf83486

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-26158.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    7a594d89b9d35662bfebc64dce1c892c

                                                                                    SHA1

                                                                                    61de1cd39b98c595f5aa980c57a4b97059f3f3ae

                                                                                    SHA256

                                                                                    e8e157c7cc64987ab27eb7d160d1452367aecdb6352c97ff59cda7c809654499

                                                                                    SHA512

                                                                                    bcdac558a7788cabee16b2eb76812f0a11b4596b1e97ecb375275382505eddefea47b09a7ab078e02782fbc10b24a2d464d84de2b51e0583587d40965e75b25e

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-29496.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    d8caca5f2e8b4e9ba7df98814944a9c9

                                                                                    SHA1

                                                                                    7895f231ea4bb169705876345be605b3592cc14f

                                                                                    SHA256

                                                                                    79ab7c4385fb61233608d4000dfa75dcfa564f66d56a025e5e80de537e09ae2a

                                                                                    SHA512

                                                                                    ad9b56f8e411948b4c3672863e4cad502d3af884719376b1be60112eae9646fa8abe3a99121403f7a7a75d89d6b5def4669269dfe82d9ea585e9eef2b79c67c9

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-31394.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    a67beb285db82ee300b7eb1e10833cbc

                                                                                    SHA1

                                                                                    3dab7671ab7546e562f8e36f9995712f71dee1d3

                                                                                    SHA256

                                                                                    f06f6903adad683a3d0b85253614308a76087626160b98ad4ac995399c499177

                                                                                    SHA512

                                                                                    cec412ea75adacf7b3a0f1247135353a68bbc717320784df3fca0c87baca1b11c2fdcb3bb3fc937e56705266c9390074540bef1e8faa0013731c3020345cd292

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-34332.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    42f8905827f05bc08c59b3ad1542b6ad

                                                                                    SHA1

                                                                                    619bf19b282a4bdd71654593e4e9f9deefad6973

                                                                                    SHA256

                                                                                    edc5b3acd778a35bf9355048960ee77a00aba3e283dcc96ce7b7ffdd46196825

                                                                                    SHA512

                                                                                    0cda4b4198bda845fed14a17fd2d0a760e47299e189456e0de433eeeae22e20c3675e25b21add9bbb8e86258f72bf376f6522cdbcfc6b947e4ee8911320ebfd0

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-34711.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    6f618ba037569bbc3627795ff83d91d6

                                                                                    SHA1

                                                                                    2cf7cf65076d060cb81d30ce4de084594b8d1f9b

                                                                                    SHA256

                                                                                    2d514dea7f10c60e6037d58c850c8d50a2d65fe480fef234f7b849bdf9c80c01

                                                                                    SHA512

                                                                                    b94b0cca1ec58f3daa65ebedf4d04ed6421e681407b72126624aa1b61906efaf084434e427f00f118fdc13f0cbdd10ca659a234d1f402f94b967dd2068e2de65

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-34886.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    51d6a8316c3ab0199ea35c8984ed2ce6

                                                                                    SHA1

                                                                                    83f575e44f7d00be132a7cd6c47a219e9b07cdbe

                                                                                    SHA256

                                                                                    8f63026169b5a95979474eeea6b21cc65e956ec0a1cebf384ed2454efc9721ea

                                                                                    SHA512

                                                                                    019d982089ca5ed2fd281e241f32cfbe421a00984fc46d2e97bbf8dc0266acc0e36bb1a70cb7f734452dde8082c30578102bcee1b0a82673fe471e26c4e4e9e6

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-34903.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    4192e30459649dbddc5c32b0ef1e47c1

                                                                                    SHA1

                                                                                    bfcd9e7f17912c55e4f0319b4306e5743bd4bf16

                                                                                    SHA256

                                                                                    7ada472d035bcfe040acbee99b0392f89903c6dff9e35ac8702f58347997a812

                                                                                    SHA512

                                                                                    571c24ec9153bf07546051ffa1ea56d548df191f931981a265d75cfc1787069ac47da311d7b6c444906f1b452d5a0db13468dca712dad6e698b0c1e18216b717

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-42302.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    dc72bb2227d79fe3475bb2cd2051f9e4

                                                                                    SHA1

                                                                                    44b322b6c92c628fc903640ac3ec435ec0a9c45e

                                                                                    SHA256

                                                                                    8f72d8c398f12748d6cfc55d013ba54b03419dede5611b70a98865d47d898142

                                                                                    SHA512

                                                                                    62174289ba73aa948399792209c4966f0fb7597f44b0dfecf2053ed6feaf32d742280a648fd8ea256a410de58cdedd3f7c03019ae29bf8d468e471c9099bfc50

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-43403.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    ac52adc5d6ef8c3e4c3cd7d0622841dd

                                                                                    SHA1

                                                                                    6f586f031812590db4853b9c22682a78639d4067

                                                                                    SHA256

                                                                                    a1a360eb69b48e9a1427cdcd4b4804890c1610c9290fc2dd21f6bb889c58cff3

                                                                                    SHA512

                                                                                    dfdbd21c2f075b251885f527ec967bc5f7803ab784b648aeaad34ba520acf1e65d5b49aa74889ce30764d46276b3b904b3929f7705f45f0a1961bf22aa7ea8df

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-51260.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    03b2db446b599b0b3ef368562c1dc992

                                                                                    SHA1

                                                                                    34585cbfbc3506d91e705af4aa9b2a148c54fd66

                                                                                    SHA256

                                                                                    a20e37a724819f62c4f4f60842bd4c4bf54250dfb55b1d03012e17442be3a5e4

                                                                                    SHA512

                                                                                    616f8f4513bddecf09cb7ad801986b9ad78cf4ff948d447516ee53d11d49dc1642bb1a913c98efa4c048c720437ff9103c3cde232267153f6026e9d41b5872eb

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-55878.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    ad26b7b0d59920a8d7d0b0020f041704

                                                                                    SHA1

                                                                                    d4f3474609c4f20206f237cc6853b974d86d023c

                                                                                    SHA256

                                                                                    097b5df128026f5add7d194f7236e97ef993730935a837b2b4bc13d549acdc34

                                                                                    SHA512

                                                                                    5175b3336412a25a44661f80d893f1d34f5cd1d87d284341cbdebbe53b4f9ae49e56f4a6a5ffc1ef89223d1ba5477a01d8041501ce13d34d8647c699290b384a

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-58966.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    1ab2b379dae4c50eb0fe7812cce00eb4

                                                                                    SHA1

                                                                                    85868b3d96481e1d64d4fa6a8b3d072faff74f02

                                                                                    SHA256

                                                                                    b204d3e4c037850887b60abda6aeee4ec852cd79bbe50418061a41b8cf6cc6e5

                                                                                    SHA512

                                                                                    89640a2b148574a08d26781992bf104777c9556afda00ea15a8cd4fb78a97e5fce72535e4e32bfd22f9c181d1c9fa64464dd7df5f40bb4147bdbcefce8e9a9b7

                                                                                  • \Users\Admin\AppData\Local\Temp\Unicorn-62168.exe

                                                                                    Filesize

                                                                                    184KB

                                                                                    MD5

                                                                                    cdd9a42d6c103b421604d7d4515a03a3

                                                                                    SHA1

                                                                                    00002faac9ef2e4fdc212a7bda797d0d08690076

                                                                                    SHA256

                                                                                    4fee9c9a1f00417f7e5c5aa88766d6fe717551fc8596bf82d0c034d50cfc824b

                                                                                    SHA512

                                                                                    703943560cf658eec27aa2eae40419ac2aec7c0e5d6fcc686bfd79080b95c61ed3a3ada383f03c414511593db93bf81eec8ee9d250f8b64b1f4ffe082c072927