Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe
Resource
win7-20231129-en
General
-
Target
61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe
-
Size
7.2MB
-
MD5
5446af14bfb2bf63ec1b409a0752f2bb
-
SHA1
2d0ed53f2bab261a09e50e35b95f896ddf6dd688
-
SHA256
61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434
-
SHA512
3f96ff6656d7937fe3be66688c5559a238be9e0277373dd8a325f2e36fbd50095285ae8da8db0b59f0706b9514bdf54f2f66da81caf4d2818b9c9d20d5cff436
-
SSDEEP
49152:OSa5+lvH/3ehlWOU9Hl73KkPjOMVMC21gt9dmFF9KINW1FQr7qrzW+x30rY6yTK4:A0X3IWbXPjObC9CFAArmGm3U0KFK/j
Malware Config
Signatures
-
Detect ZGRat V1 32 IoCs
resource yara_rule behavioral2/memory/2732-36-0x000000001BEA0000-0x000000001C22E000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-37-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-38-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-56-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-72-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-68-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-64-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-62-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-60-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-58-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-54-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-52-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-48-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-46-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-50-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-42-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-44-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-40-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-90-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-96-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-94-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-92-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-88-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-86-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-84-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-82-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-80-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-78-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-76-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-74-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-70-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 behavioral2/memory/2732-66-0x000000001BEA0000-0x000000001C227000-memory.dmp family_zgrat_v1 -
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1920 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4640 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 60 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 708 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4516 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4728 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1188 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 3212 schtasks.exe 98 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3872 3212 schtasks.exe 98 -
Detects executables packed with unregistered version of .NET Reactor 39 IoCs
resource yara_rule behavioral2/files/0x001100000002324d-4.dat INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/3732-11-0x0000000000400000-0x0000000000B37000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/files/0x000800000002325c-16.dat INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4236-23-0x0000000000400000-0x0000000000AF3000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/files/0x000700000002325e-27.dat INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/4880-33-0x0000000000400000-0x0000000000A98000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-35-0x0000000000970000-0x0000000000FC0000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-36-0x000000001BEA0000-0x000000001C22E000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-37-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-38-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-56-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-72-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-68-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-64-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-62-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-60-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-58-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-54-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-52-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-48-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-46-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-50-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-42-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-44-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-40-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-90-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-96-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-94-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-92-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-88-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-86-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-84-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-82-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-80-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-78-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-76-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-74-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-70-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor behavioral2/memory/2732-66-0x000000001BEA0000-0x000000001C227000-memory.dmp INDICATOR_EXE_Packed_DotNetReactor -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1944 powershell.exe 1620 powershell.exe 1528 powershell.exe 1156 powershell.exe 4980 powershell.exe 4480 powershell.exe 3524 powershell.exe 4688 powershell.exe 824 powershell.exe 4952 powershell.exe 3288 powershell.exe 2004 powershell.exe 3896 powershell.exe 2524 powershell.exe 4124 powershell.exe 4736 powershell.exe 4156 powershell.exe 5012 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Province Hacks.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Logger.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1.exe -
Executes dropped EXE 4 IoCs
pid Process 4236 Province Hacks.exe 4880 Logger.exe 2732 1.exe 5520 unsecapp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4892 schtasks.exe 1360 schtasks.exe 3872 schtasks.exe 4776 schtasks.exe 4108 schtasks.exe 2344 schtasks.exe 4640 schtasks.exe 60 schtasks.exe 4728 schtasks.exe 1920 schtasks.exe 2644 schtasks.exe 4756 schtasks.exe 708 schtasks.exe 1188 schtasks.exe 3600 schtasks.exe 4516 schtasks.exe 2284 schtasks.exe 1136 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 1.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5720 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe 2732 1.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 2732 1.exe Token: SeDebugPrivilege 4688 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeDebugPrivilege 3524 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 824 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 4156 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 3288 powershell.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 5520 unsecapp.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 3732 wrote to memory of 4236 3732 61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe 92 PID 3732 wrote to memory of 4236 3732 61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe 92 PID 3732 wrote to memory of 4236 3732 61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe 92 PID 4236 wrote to memory of 4880 4236 Province Hacks.exe 93 PID 4236 wrote to memory of 4880 4236 Province Hacks.exe 93 PID 4236 wrote to memory of 4880 4236 Province Hacks.exe 93 PID 4880 wrote to memory of 2732 4880 Logger.exe 94 PID 4880 wrote to memory of 2732 4880 Logger.exe 94 PID 2732 wrote to memory of 1156 2732 1.exe 122 PID 2732 wrote to memory of 1156 2732 1.exe 122 PID 2732 wrote to memory of 5012 2732 1.exe 123 PID 2732 wrote to memory of 5012 2732 1.exe 123 PID 2732 wrote to memory of 4980 2732 1.exe 124 PID 2732 wrote to memory of 4980 2732 1.exe 124 PID 2732 wrote to memory of 824 2732 1.exe 125 PID 2732 wrote to memory of 824 2732 1.exe 125 PID 2732 wrote to memory of 1528 2732 1.exe 126 PID 2732 wrote to memory of 1528 2732 1.exe 126 PID 2732 wrote to memory of 4156 2732 1.exe 127 PID 2732 wrote to memory of 4156 2732 1.exe 127 PID 2732 wrote to memory of 2524 2732 1.exe 128 PID 2732 wrote to memory of 2524 2732 1.exe 128 PID 2732 wrote to memory of 1620 2732 1.exe 129 PID 2732 wrote to memory of 1620 2732 1.exe 129 PID 2732 wrote to memory of 2004 2732 1.exe 130 PID 2732 wrote to memory of 2004 2732 1.exe 130 PID 2732 wrote to memory of 3288 2732 1.exe 131 PID 2732 wrote to memory of 3288 2732 1.exe 131 PID 2732 wrote to memory of 1944 2732 1.exe 132 PID 2732 wrote to memory of 1944 2732 1.exe 132 PID 2732 wrote to memory of 3896 2732 1.exe 133 PID 2732 wrote to memory of 3896 2732 1.exe 133 PID 2732 wrote to memory of 4736 2732 1.exe 135 PID 2732 wrote to memory of 4736 2732 1.exe 135 PID 2732 wrote to memory of 4480 2732 1.exe 136 PID 2732 wrote to memory of 4480 2732 1.exe 136 PID 2732 wrote to memory of 4124 2732 1.exe 137 PID 2732 wrote to memory of 4124 2732 1.exe 137 PID 2732 wrote to memory of 4688 2732 1.exe 138 PID 2732 wrote to memory of 4688 2732 1.exe 138 PID 2732 wrote to memory of 3524 2732 1.exe 139 PID 2732 wrote to memory of 3524 2732 1.exe 139 PID 2732 wrote to memory of 4952 2732 1.exe 140 PID 2732 wrote to memory of 4952 2732 1.exe 140 PID 2732 wrote to memory of 5308 2732 1.exe 158 PID 2732 wrote to memory of 5308 2732 1.exe 158 PID 5308 wrote to memory of 5752 5308 cmd.exe 160 PID 5308 wrote to memory of 5752 5308 cmd.exe 160 PID 5308 wrote to memory of 5720 5308 cmd.exe 161 PID 5308 wrote to memory of 5720 5308 cmd.exe 161 PID 5308 wrote to memory of 5520 5308 cmd.exe 162 PID 5308 wrote to memory of 5520 5308 cmd.exe 162 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe"C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe"C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\Logger.exe"C:\Users\Admin\AppData\Local\Temp\Logger.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\msedge.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mk9gQGmwZ5.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:5752
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
PID:5720
-
-
C:\odt\unsecapp.exe"C:\odt\unsecapp.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5520
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:1232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\odt\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "11" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "11" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD560804e808a88131a5452fed692914a8e
SHA1fdb74669923b31d573787fe024dbd701fa21bb5b
SHA256064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61
SHA512d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
6.3MB
MD54e2c3489ec26807d69f9171479886188
SHA140f8c57e6918d1626177810c6f1b5a65d9bf93d1
SHA25633466d0c92e0fb64d98b89ca503976b86cfd5400c387aeb9dd66f096b4c14ca9
SHA5120ed949039d77b4777f8da9ede1e245b22759fa2bd86ec90692c216263a27693264f926ad256336a8b4e2e688c05deb4790ba0a2799479213a9cb9960787f0d3e
-
Filesize
6.6MB
MD548bfaeb0285f1b090cbf09e2feb6ad10
SHA167d25ecce37f5a70ec950758351e81593b99ed05
SHA256d8c19254251b41d6f815582ba4c018994cae3bdf3677e198a88138a43aaaf15e
SHA512f8f19c480a72dcb1a88585a94c95767dfdaab0320aafd46f61309385fd9f7e68a8b392801ab243e7c545f43cd9e23366aa94814a05d9f9a0b604c22ab81ad08d
-
Filesize
147B
MD5710dcd1097713344551a8ebdd8ca517d
SHA1c9c03562adaac741336e4cd5cf774872274ff28d
SHA256565fc63d25b97a5b7b5ac6ddb0df1bb9a152f1cf2baa124de88433e13a189981
SHA512c4b6b79e2c50c55a8824314bc39ee12686a0e42080f57aa5ffbcda7910c9a5c810c717ba401208ade9a792d63bb670e65c95ccb82219ca96955cbb81032d58d0
-
Filesize
6.9MB
MD5d22490055518bbf8d44579a00453da46
SHA1d738768635f9646c71b98befc3bf2a4c9f5c29e3
SHA256ee2c37126091fa67a5b5abbf7ac2a4271514ec7620aef87b34d42e80c576cd0a
SHA512ecdd5baf602b3e9e59f15b47ad3925026568be9fdf1d384cc3dbae2b292abbf1878cbd1f919cf680442c65a9299c3496d9f03fed8b8504ba34f805e5ef984f08
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82