Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
Eurovisioner.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Eurovisioner.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
General
-
Target
Eurovisioner.exe
-
Size
548KB
-
MD5
e90feee8c6994f0cd73a792ea886693c
-
SHA1
e0c070b38f16693aacc47a0c11e5a0036191b1db
-
SHA256
a31748dd0aa6f53cbfa189bef070a2304e385ef18c0bab5672e039c4a12c41f7
-
SHA512
07158b7462c3ca51f0ce5737cab77ea93144105f40117341a6e79624c5ac7492365a85ce724724de9ff845367ebf1b44e061a19410b860699ce349676b0ba707
-
SSDEEP
6144:h1onKQNqlcuBZB478o/iDx5ux04TcMR5C33BlqS0gGD3WNfX5Slhv2:TozEBTyH/wzuO4TvC33vWgGDGxSl92
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.escolaprofissionaltomar.com - Port:
587 - Username:
[email protected] - Password:
*Acnbc232430# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 64 IoCs
pid Process 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe 1876 Eurovisioner.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 5 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tvungen.ini Eurovisioner.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1220 Eurovisioner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1876 Eurovisioner.exe 1220 Eurovisioner.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1876 set thread context of 1220 1876 Eurovisioner.exe 574 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\opvaskene.ini Eurovisioner.exe File opened for modification C:\Program Files (x86)\Common Files\Lymphoidocyte.ini Eurovisioner.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\lejerets.Arb Eurovisioner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1220 Eurovisioner.exe 1220 Eurovisioner.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1876 Eurovisioner.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1220 Eurovisioner.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2632 1876 Eurovisioner.exe 28 PID 1876 wrote to memory of 2632 1876 Eurovisioner.exe 28 PID 1876 wrote to memory of 2632 1876 Eurovisioner.exe 28 PID 1876 wrote to memory of 2632 1876 Eurovisioner.exe 28 PID 1876 wrote to memory of 2644 1876 Eurovisioner.exe 30 PID 1876 wrote to memory of 2644 1876 Eurovisioner.exe 30 PID 1876 wrote to memory of 2644 1876 Eurovisioner.exe 30 PID 1876 wrote to memory of 2644 1876 Eurovisioner.exe 30 PID 1876 wrote to memory of 2944 1876 Eurovisioner.exe 32 PID 1876 wrote to memory of 2944 1876 Eurovisioner.exe 32 PID 1876 wrote to memory of 2944 1876 Eurovisioner.exe 32 PID 1876 wrote to memory of 2944 1876 Eurovisioner.exe 32 PID 1876 wrote to memory of 2100 1876 Eurovisioner.exe 34 PID 1876 wrote to memory of 2100 1876 Eurovisioner.exe 34 PID 1876 wrote to memory of 2100 1876 Eurovisioner.exe 34 PID 1876 wrote to memory of 2100 1876 Eurovisioner.exe 34 PID 1876 wrote to memory of 2724 1876 Eurovisioner.exe 36 PID 1876 wrote to memory of 2724 1876 Eurovisioner.exe 36 PID 1876 wrote to memory of 2724 1876 Eurovisioner.exe 36 PID 1876 wrote to memory of 2724 1876 Eurovisioner.exe 36 PID 1876 wrote to memory of 2500 1876 Eurovisioner.exe 38 PID 1876 wrote to memory of 2500 1876 Eurovisioner.exe 38 PID 1876 wrote to memory of 2500 1876 Eurovisioner.exe 38 PID 1876 wrote to memory of 2500 1876 Eurovisioner.exe 38 PID 1876 wrote to memory of 2536 1876 Eurovisioner.exe 40 PID 1876 wrote to memory of 2536 1876 Eurovisioner.exe 40 PID 1876 wrote to memory of 2536 1876 Eurovisioner.exe 40 PID 1876 wrote to memory of 2536 1876 Eurovisioner.exe 40 PID 1876 wrote to memory of 2616 1876 Eurovisioner.exe 42 PID 1876 wrote to memory of 2616 1876 Eurovisioner.exe 42 PID 1876 wrote to memory of 2616 1876 Eurovisioner.exe 42 PID 1876 wrote to memory of 2616 1876 Eurovisioner.exe 42 PID 1876 wrote to memory of 1156 1876 Eurovisioner.exe 44 PID 1876 wrote to memory of 1156 1876 Eurovisioner.exe 44 PID 1876 wrote to memory of 1156 1876 Eurovisioner.exe 44 PID 1876 wrote to memory of 1156 1876 Eurovisioner.exe 44 PID 1876 wrote to memory of 2428 1876 Eurovisioner.exe 46 PID 1876 wrote to memory of 2428 1876 Eurovisioner.exe 46 PID 1876 wrote to memory of 2428 1876 Eurovisioner.exe 46 PID 1876 wrote to memory of 2428 1876 Eurovisioner.exe 46 PID 1876 wrote to memory of 2640 1876 Eurovisioner.exe 48 PID 1876 wrote to memory of 2640 1876 Eurovisioner.exe 48 PID 1876 wrote to memory of 2640 1876 Eurovisioner.exe 48 PID 1876 wrote to memory of 2640 1876 Eurovisioner.exe 48 PID 1876 wrote to memory of 2996 1876 Eurovisioner.exe 50 PID 1876 wrote to memory of 2996 1876 Eurovisioner.exe 50 PID 1876 wrote to memory of 2996 1876 Eurovisioner.exe 50 PID 1876 wrote to memory of 2996 1876 Eurovisioner.exe 50 PID 1876 wrote to memory of 2608 1876 Eurovisioner.exe 52 PID 1876 wrote to memory of 2608 1876 Eurovisioner.exe 52 PID 1876 wrote to memory of 2608 1876 Eurovisioner.exe 52 PID 1876 wrote to memory of 2608 1876 Eurovisioner.exe 52 PID 1876 wrote to memory of 1808 1876 Eurovisioner.exe 54 PID 1876 wrote to memory of 1808 1876 Eurovisioner.exe 54 PID 1876 wrote to memory of 1808 1876 Eurovisioner.exe 54 PID 1876 wrote to memory of 1808 1876 Eurovisioner.exe 54 PID 1876 wrote to memory of 1960 1876 Eurovisioner.exe 56 PID 1876 wrote to memory of 1960 1876 Eurovisioner.exe 56 PID 1876 wrote to memory of 1960 1876 Eurovisioner.exe 56 PID 1876 wrote to memory of 1960 1876 Eurovisioner.exe 56 PID 1876 wrote to memory of 2240 1876 Eurovisioner.exe 58 PID 1876 wrote to memory of 2240 1876 Eurovisioner.exe 58 PID 1876 wrote to memory of 2240 1876 Eurovisioner.exe 58 PID 1876 wrote to memory of 2240 1876 Eurovisioner.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2644
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2100
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2724
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2500
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:1156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:2996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:2608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2240
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1832
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1256
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2288
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2252
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1316
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2492
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1048
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2468
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2060
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:1720
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2592
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2884
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2136
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1212
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2120
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2516
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:2128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:3060
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:1300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:2900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2652
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:2904
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2424
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2120
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1236
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1032
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1316
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1612
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2024
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3060
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:1300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3000
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2232
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2780
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1824
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:1624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1204
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:880
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2288
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:3068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2116
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:568
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:1308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1360
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:1292
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2512
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:904
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2092
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2680
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2644
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2732
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2172
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2848
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1984
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:3024
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2080
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:276
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1572
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:3012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:1676
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2120
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1832
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2252
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:1500
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:988
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1844
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2504
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:2860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2368
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:2148
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2412
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:1144
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1368
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1340
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:684
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1636
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2728
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2692
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2224
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2612
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2676
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2892
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2608
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1652
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"C:\Users\Admin\AppData\Local\Temp\Eurovisioner.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37B
MD5e13e9d5b2397a5759ca52f5facbe9bb4
SHA1718daa072689802474818abe65e8329be26ed638
SHA256314ad250724df3c35e626250465fa0f268fc5f029777b73fc34b873c20b9e0f6
SHA5125febc52acd109e21112bd37a7091c1adab1b6dceb42f1c56567c15b0aae2704b9cef92c605f52ad98fd229ad19ec17d581c850cb7f76389e9002cf02ff3152fe
-
Filesize
11KB
MD53f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA5120a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
-
Filesize
6KB
MD5b5a1f9dc73e2944a388a61411bdd8c70
SHA1dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA256288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
SHA512b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8