Analysis
-
max time kernel
126s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30-04-2024 01:56
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
350273e0d2e8a9ba5e37b791016112a0
-
SHA1
5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
-
SHA256
27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
-
SHA512
b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops desktop.ini file(s) 7 IoCs
-
Drops file in System32 directory 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\Winhost.exe2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\Winhost.exe2⤵
- Drops file in System32 directory
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Public\Documents\Winhost.exe2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Winhost.exe3⤵
- Drops file in System32 directory
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Winhost.exe3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
- Drops file in System32 directory
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Users\Public\Documents\Seven.dll2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Drops file in System32 directory
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Users\Public\Documents\Seven.runtimeconfig.json2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Drops file in System32 directory
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Seven.dll3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C start C:\Users\Admin\AppData\Local\Temp\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exeC:\Users\Admin\AppData\Local\Temp\Winhost.exe3⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"21⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"26⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"28⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"29⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"31⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"33⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"35⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"36⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"37⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"44⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"45⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"48⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"50⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"52⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"54⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"57⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"59⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"62⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"64⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"65⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"67⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"68⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"69⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"85⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\Winhost.exeC:\Windows\System32\Winhost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"18⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"19⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"20⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"21⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"22⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"23⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"24⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"25⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"26⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"27⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"28⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"29⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"30⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"31⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"32⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"33⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"34⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"35⤵
- Checks computer location settings
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"36⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"37⤵
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"38⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"39⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"40⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"41⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"42⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"43⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"44⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"45⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"46⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"47⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"48⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"49⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"50⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"51⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"52⤵
-
C:\Windows\System32\Winhost.exe"C:\Windows\System32\Winhost.exe"53⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5e8aaa566651759e399714d464cdfb390
SHA1373942a3618c8d5ff0ba8aab8e22d4a64e5641ae
SHA2561a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a
SHA51223f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2
-
Filesize
16B
MD5209371fb985ae536f7a01b2cbf06fdeb
SHA16e5d735e5a6aef442f3342931eaf47d505763578
SHA2564cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3
SHA51253203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe
-
Filesize
77KB
MD5f02236d4405a64d5d517446b74c7d9e9
SHA1916bb004951fc6c239cc710aeceaa2230b0bf19d
SHA2564bfc4df0bdb17685d97b9926b56ca29ed0ad4096ec9d94a6b2043e2c72a04c9b
SHA5127717eb30b6636be3b1293449c91abdbdbff7ec7c4bf869818814dbef1d7ea74ec33ace21f3a805fa600bd1db2c1a8b5d6c4792d4f39c3061a40b3d0e0b619080
-
Filesize
47KB
MD522e53dc5709ced95e3c83af5804336a6
SHA10163069ed72c9616e06d8997c1f5d7fba597b0e0
SHA256a128f39f65bd1068191be32727905f92217b625bde930a65ffae3250ec557373
SHA512ce53d6e40b75737475193824dba4026508f9315be3a79698c3f5529863fad78bec5456b7e6f5971b08d5df5d753bc3dfe83dfa0aecb180d67ce970f6f2ef8dea
-
Filesize
66KB
MD54a90573d4e1350bb3cb06a825fbd66de
SHA13f3ce3606d802cd06dda067fa2a07dfa745c90df
SHA2565a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242
SHA512b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c
-
Filesize
75KB
MD5ab69555e8ae9d8ff1de5605724761c5f
SHA13e09f9b5cfaf45fb19a8ff5c3ff884f570015171
SHA256358df7dc00b3290428a7551c7ea07259efbcd6afee694654809819d1ef6604e5
SHA5125c372847305cf5157b59e0479367560e3e36291055c93f80e41c33d2a711d35d2009cf314b06ec0c5b925d690957d14ee86218d9b4f9afb1d8883f70cd05793b
-
Filesize
80B
MD577c91d4087daf527f51d3462b8235705
SHA11ac9be8957feaa1353ccb06468a3c4037592122b
SHA2563d4a7778260a02dc1a997be06ab69eb0f1d13516b485ed631f5dbf0ebcfc0f94
SHA5121feb58d58051145772e45c4cd2f65979046dddd6128d39d3c108c60a0da138bfba5589bb26bc28071442923c0ae099188a9f6fa862d92611b27df8beb5d2c94d
-
Filesize
80B
MD5ae649b0a162dafc24b88a5c5f42eddec
SHA177586b76849971519c8a45b8fce97ecc9aeeedcb
SHA256abe98f0b6dd3a8cf43144e7475450f551d294ed37409573c19b0e9fa774f8549
SHA512ba6fb3e5419f18939e5be31e7aa902fc529715ca469f5e874b1b14f0201bf92ae8451ab35cebbc99387f13b5b3bef45554b9583eea6ea2b6e807a7a88d59a9c2
-
Filesize
80B
MD5cabf2d81a1fdd4f6ab4a462fdb59f669
SHA1c09ac236e603fbd981b47b74417007010dfbb0eb
SHA256833193d3bc0098b9f64207d2fc13191de355c5d691c350df657d6f788ab479e4
SHA5128307d3d1ae7d8a3d7fad6a6b75f3f70ea0dd0f2f111ac4cfbb6738e28700accc4a28ce59eb357072d37608fdc502c3cfc3f3aa66c386ab612bab573917f55941
-
Filesize
64B
MD556099629156b7048571056cc70cb35af
SHA12f81ebbabd710a3cbff9a7f7083164708e7e2aa5
SHA256a90ef6f8ee7fdeb156955da34e205fdbaed02ab92fdb746eb1323625c74d9183
SHA512231387f09b86ae8207ee0063faacdd56ef4f4abb5086b00706a4dc0b12034d39692987b495d0dedc9efcbc4c76234c8eae1d545a273da2daac5216354617d2ee
-
Filesize
64B
MD5d792e7641605851f59cb32c5086ff7c0
SHA1d8d111c2e6c970d3eb579562e6302b8beab1c099
SHA25652942eb20ef991682a823781d636dd7e36f1067aa674214f6d2c526c16747fa9
SHA512f49dd08ffa6c1e1e47c9a95c044cd4b36ab211c0d239c5e95924c2475496814dad1371490fac8dbddd9bc6b30e1f5071102b50021b0cb1ce27becdcced926197
-
Filesize
139KB
MD5350273e0d2e8a9ba5e37b791016112a0
SHA15bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
SHA25627297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
SHA512b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.3MB
MD5b5354db7c3200ccec55fd08c45871d59
SHA1ecc498dcc425d9d803dcd0eec5efba18c654fc58
SHA25690d1ad22e058d66acca5e10b5095d857fcb295143d4538930650765eaa25367d
SHA51258a26c369977bc4fe735dfad9abf062a16fa0f2af3decf92f71339c374751ebfc8e4760ddd01266fc70bfe4bb56b936140e776a742a2b188d7a692029ba627c7
-
Filesize
340B
MD5253333997e82f7d44ea8072dfae6db39
SHA103b9744e89327431a619505a7c72fd497783d884
SHA25628329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
SHA51256d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
-
Filesize
380KB
MD51eab13731e31b397c2d937bd7a4cbca7
SHA1a82849d272c2ba666d11a38fdbaf1fdaf1a9c006
SHA2567d893f14663588030bfc765905459a9adc35ffe649d64b16af3ce08e4f765b73
SHA512e729445739ecb9c5d6b0dcb8df0f52286e97f28dfad9bcb36bf16b2c6fdb18c1f1ebfdfbf93cd4ddedd74d6e3fdc3254b0999023a200dae0a7b94cca2f6b2cab
-
Filesize
86KB
MD50df794a4926931ade27e025318de71f5
SHA1a2835d72dc2e8bc231e9b92992d6417c7dc262e4
SHA2560bc2b4a17e5c8111db8eb34a758f418918257d70340a7fa70658bf3e7e534a05
SHA5120e0d5be412d42f173f81865ff7453790e386e701002161cf1581d8425cb02a29eca66352820c9ccab0c33c8310356f9dc76a3e821ce7b6c14c1b3c8d0633469d
-
Filesize
395KB
MD546fd901088d544f1d677790d2eff337e
SHA1a7ca17e9bd9bc7316e6c19d85eb7926465a6d7bb
SHA25613ca1e522a06c072394df5b360088292a974fee6193e7188b41c51d25e53cbb2
SHA51237bd2e5b065f7c114ca85f1f6eedc64044973c6e7d88542b27b6e48d4c5260cd2646e20bb0a306cae4a86f531dccdcbab8d16b60f58cc6b41c9dcf08c44f38bc
-
Filesize
80KB
MD5e0f2c72b44d8ddfe51d57445ee2a967f
SHA126cae2f90c6f94a361c36d3cf7b0d6df93b2159d
SHA2569e223ecb362b4fe88e152ac5ec5ebce5dacb797f783d1cb21a4797223496ed7f
SHA512dfd3f333944394c3cbba8eaea8b5364073b789fe91452ca155357e8ca3a50db7ae2c3feb9575ff01aeb9279247a1e8d1a00bcd7a0544a084ea8828417935d7c8
-
Filesize
167KB
MD520ef552c3e34590d881b2f894515cf84
SHA1536a1b7eb37a52db846a8d59f4da7ddeec82d620
SHA256d1c62dbefe9a66b6b56ba4fbc4f7613cd40736ceb20d41ed8e4927c6898fa01d
SHA51209af794045f636954fd1093e741e4d6005d0910af09f0c413e62d886dc82afaab85a3f89330e96bbc419b96a4689217f623067b3f0943ef70a0600d4a546d6de
-
Filesize
195KB
MD511ddce4984daa5ad6a041c17829831f1
SHA1867a27480967f35b013da3dd1267b252304b546e
SHA25604412922cd7ef9a3deb60ac7e5a0e7830842de318807e7f9b2f6d360e663f740
SHA512a9a377a0f4ccca7dc629381ffaaf36f18a85068e1b23171b04d9d7ad8501cc1af18fdfc0a2f94abfeba2e847b41ef52946000894d8babaca3e4a18db430e87d8
-
Filesize
170KB
MD5ed1fc913d119aba9804b5c4b25f7a30f
SHA1f613d44f24a08ac91b33bd4589229016323fd525
SHA2568f29094e27e83021294303ad35b02c28881612bd063d85583147670284bd1f13
SHA512528e8d07728ca461a908935adbc465c08b816b3e784a2bacdd14093632589b77560f298d3068b6c32f5901600bfdefbbc2d20550cd1ad89702622f99a70a5fc1
-
Filesize
208KB
MD54a35122004a0db2c3343571f749e89f3
SHA188c1ea67e6e2dd7ba8dc6e11f5b7f3c64b13a8fe
SHA256ad979399d026462bf1f7ddc8fc0713b25910b7b03c94c2e8a88771a9d6373f84
SHA5129683b7c5024f0744c5cd13ab2c3f746072c99bc94e9013249ed830bda225906ec80f9255bd60c974004cc30fe0fdbb4da07470cc02a11eb24504b2d4ed137a45
-
Filesize
170KB
MD52d3cd09bd5b403a7b26e9476e016b9bc
SHA13ed7cf525c2e6378f47c260c72e6258247fec6ad
SHA2562b07b427082d60b7ba4547a1d7f1764df7ce6b5faadeb2e6345daade01de9783
SHA512b38d494f6a7e525f9e3183aeb5274a924400aed281681e3c25ad310d7fb9af8e6072ca43caf8b60210b7cda978081374ce6b0fda49e59c1c574d13fea7c4e9c4
-
Filesize
190KB
MD5f1333dc20e7118023b30b47b575e9382
SHA1902d7f284488f18950584fd7a17dfdac1a97679c
SHA25611acf9980340cc4a5fa04eea4d9690543bbb5c3ca9e11b07a51ff5af268d8ec8
SHA51249505bb5c95eef1b3fb79bff97ed254701d817588ae72ee59868f4d0ebc717cf3a0f3609c60d50ee03cf1ff82914157640b177a99d0eb0b7723784aba14fb624
-
Filesize
170KB
MD5a3ffac93565245bf6f535f980b22851c
SHA1f5a2a32dd47b546ff513d24bd1e36c725d27b4ae
SHA256f1cb125df6358219543782c010ad0ff22d092390c69976798b7470306e2d9656
SHA512ddfdb05c201151e259744dd9d533bf7b2a72187c5be5a5e7e6b2d002b83b2dda3df23b14a63a06101fc46f9a5d51687d3d5ca5afa18286e4fef4b39aba1222ef
-
Filesize
198KB
MD5014ee7e6219ad61a714d6e16e4951eac
SHA1d1ccf4c3e736e26460f52b1587c989c6b5d4e9f4
SHA256332a7b3c1228d696a273faa1e220f9a8804797e2313284095a467d313b4c0937
SHA5125fa738cc61c86761285c12bbaecb4e16770470fdf78142ee6c398c63eb346fb21a53b181ebf7714a0c3ca0fa6661abbb1c094076e856084e43580f034d3bffa7
-
Filesize
123KB
MD5f00b588084b82344029a8c10cfef0d99
SHA1a50a35ac336f79d92cd7e46e5e46a87f8ef91945
SHA256fb996e57ba745d86f5264185176cc74a26b5eb8eab24c5f65d7c456868ab117a
SHA51290b00fae82d767a8ee4a852ce1c161e5a8c20cf31a8b8432378af3fa29b5c41bcb2b19ac49474ac444fb82c766518726d713d0a50565174e5d9f5fcc93bef0ba
-
Filesize
129KB
MD5a17f1d3ea333dc60f6c44255e58c721a
SHA1d36df335c4da633c07788464cbec98aaa312613f
SHA256894129381bca7500557cb0afc542c06ecbea35a4ad688ba4ef85cd65bea8a94f
SHA5125e9ab9b3fd7421ba172a04618ae272ebf51b3b22927613074ca7cd0c289a41b57e1c3bdab0c87bbabd20a39f40a4677fa902516867eeb4227de88b4284577680
-
Filesize
123KB
MD56223046c6df678974c0e0daa79821614
SHA18963fc2d4e2118ac02eadd5ebce612850a61f0a0
SHA2569cc37cf23bbf4f3b956e78765151f10fa7a8b6c299ebee6675ad897a1e8ef5d9
SHA512bd9760e7e160a1b4ce5cbc3e294f622c77e27dd998e6a01e17374f64baf1f73f694a3abe156a0043dd0e1ddb8e9651468401df4be37721eb752619c647c99d30
-
Filesize
135KB
MD5d87ec8ed93d8cecc7a960a2d5e8f8800
SHA129c41dc3fda19ccbcbc24c29bae6e1e115a3261a
SHA2561bcbd86f4ede4b59b2c9cda9e1dbd9a28effe807c21b7cf0caeaf9e6be6ed5ed
SHA51236cee6f4866101db865af6f78742480c316aa63127df510ca25e9ed361689f37ada6ed38160b3a6d30d521cc055f5825aeda8274f030dcb517eadd2ffbdf1810
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB