Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/04/2024, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
940KB
-
MD5
6e45b98d4ffb2d2b229f395272e35f99
-
SHA1
d8492fa2ca7ad3f1bd081ff43aa326fc65fc4311
-
SHA256
758600c927adb10386bfad3863e5fd950edf6340214628e5ea9260ddb994ac86
-
SHA512
ab71b249dbc676e72a9e27074c6b043af30bf4ceb2d157062879982273336dc1cbf6604e730bc343f9c71353cf171998f6d116f78ed4fa08bcc3d01dd17838ce
-
SSDEEP
24576:sBe5pdi9+vEJzbFHahHGP9S648nOUdP0P:3ezZahHL1PUy
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HOW TO BACK FILES.txt
Family
targetcompany
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: 89F5130ADAAC066EAE71AC30
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us: [email protected]
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.
�
Emails
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Detect ZGRat V1 34 IoCs
resource yara_rule behavioral1/memory/756-3-0x000000001E260000-0x000000001E4B6000-memory.dmp family_zgrat_v1 behavioral1/memory/756-4-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-5-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-7-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-9-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-11-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-13-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-15-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-17-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-19-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-21-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-23-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-25-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-27-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-29-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-31-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-33-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-35-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-37-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-39-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-41-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-43-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-47-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-49-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-45-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-51-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-53-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-55-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-57-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-59-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-61-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-63-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-65-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 behavioral1/memory/756-67-0x000000001E260000-0x000000001E4B0000-memory.dmp family_zgrat_v1 -
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1564 bcdedit.exe 1700 bcdedit.exe -
Renames multiple (7283) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ydxhjxwf = "C:\\Users\\Admin\\AppData\\Roaming\\Ydxhjxwf.exe" tmp.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: tmp.exe File opened (read-only) \??\U: tmp.exe File opened (read-only) \??\W: tmp.exe File opened (read-only) \??\X: tmp.exe File opened (read-only) \??\E: tmp.exe File opened (read-only) \??\B: tmp.exe File opened (read-only) \??\G: tmp.exe File opened (read-only) \??\R: tmp.exe File opened (read-only) \??\M: tmp.exe File opened (read-only) \??\N: tmp.exe File opened (read-only) \??\O: tmp.exe File opened (read-only) \??\S: tmp.exe File opened (read-only) \??\H: tmp.exe File opened (read-only) \??\J: tmp.exe File opened (read-only) \??\K: tmp.exe File opened (read-only) \??\L: tmp.exe File opened (read-only) \??\D: tmp.exe File opened (read-only) \??\I: tmp.exe File opened (read-only) \??\Y: tmp.exe File opened (read-only) \??\Z: tmp.exe File opened (read-only) \??\A: tmp.exe File opened (read-only) \??\P: tmp.exe File opened (read-only) \??\Q: tmp.exe File opened (read-only) \??\V: tmp.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 756 set thread context of 992 756 tmp.exe 30 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar tmp.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGNAVBAR.XML tmp.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png tmp.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE04050_.WMF tmp.exe File created C:\Program Files\Java\jre7\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10302_.GIF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp tmp.exe File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif tmp.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\it-IT\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTFORM.DAT tmp.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN089.XML tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC tmp.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4 tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml tmp.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar tmp.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WCOMP98.POC tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Median.thmx tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg tmp.exe File created C:\Program Files\Java\jdk1.7.0_80\include\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf tmp.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287019.WMF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT tmp.exe File created C:\Program Files (x86)\MSBuild\Microsoft\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties tmp.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID tmp.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Matamoros tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POST98SP.POC tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI tmp.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar tmp.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\HOW TO BACK FILES.txt tmp.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 992 tmp.exe 992 tmp.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 756 tmp.exe Token: SeDebugPrivilege 756 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeDebugPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe Token: SeTakeOwnershipPrivilege 992 tmp.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 756 wrote to memory of 992 756 tmp.exe 30 PID 992 wrote to memory of 2312 992 tmp.exe 31 PID 992 wrote to memory of 2312 992 tmp.exe 31 PID 992 wrote to memory of 2312 992 tmp.exe 31 PID 992 wrote to memory of 2904 992 tmp.exe 33 PID 992 wrote to memory of 2904 992 tmp.exe 33 PID 992 wrote to memory of 2904 992 tmp.exe 33 PID 2312 wrote to memory of 1564 2312 cmd.exe 35 PID 2312 wrote to memory of 1564 2312 cmd.exe 35 PID 2312 wrote to memory of 1564 2312 cmd.exe 35 PID 2904 wrote to memory of 1700 2904 cmd.exe 36 PID 2904 wrote to memory of 1700 2904 cmd.exe 36 PID 2904 wrote to memory of 1700 2904 cmd.exe 36 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1564
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1700
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59e4bb3e22977e014c12a1d600400e3ce
SHA1957e70e3dbcd2c87e398123f54abee34f254e526
SHA256a60118be1901b449d011c0366adf6f2c4360b0c5a4ea184b5ca30c4eb87fb22f
SHA5120a8e41c95289c636a374479aaa1df523e83cab04c534ae051fcb2f686331f37050041d07959f5e5223b19b6c2ecbc7a08341d56cee974f609ff961f363601305