Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3d861468d7b...5b.exe
windows7-x64
10d861468d7b...5b.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Flexibel/P...er.jad
windows7-x64
3Flexibel/P...er.jad
windows10-2004-x64
3Synfuel/Huspil81.asp
windows7-x64
3Synfuel/Huspil81.asp
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Synfuel/Huspil81.asp
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Synfuel/Huspil81.asp
Resource
win10v2004-20240226-en
General
-
Target
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe
-
Size
759KB
-
MD5
ab19781723f4fc95135ea1c4fab2c5ac
-
SHA1
7667881fc0adcb94eaae71e680d6779581a8a869
-
SHA256
d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b
-
SHA512
55743e56af9948f2b657a7eb5a3a324d35fd55bf0537b9d7eec8931004813cef10b1e86d3960806da4e71146c12faa8d8a056154ca1563d2f2e576412842b502
-
SSDEEP
12288:KmNKDlHyYytPO2G6hqGGHfJWqbTGPObiUB:KmCHCpA6hqbWmV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cash4cars.nz - Port:
587 - Username:
[email protected] - Password:
logs2024! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral1/memory/1944-959-0x0000000000560000-0x00000000015C2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1944-960-0x0000000000560000-0x00000000005A0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Loads dropped DLL 64 IoCs
pid Process 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 5 drive.google.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1944 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 1944 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2848 set thread context of 1944 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 572 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\Fejlreaktions.tow d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1944 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 1944 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1944 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2532 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 28 PID 2848 wrote to memory of 2532 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 28 PID 2848 wrote to memory of 2532 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 28 PID 2848 wrote to memory of 2532 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 28 PID 2848 wrote to memory of 2484 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 30 PID 2848 wrote to memory of 2484 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 30 PID 2848 wrote to memory of 2484 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 30 PID 2848 wrote to memory of 2484 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 30 PID 2848 wrote to memory of 2812 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 32 PID 2848 wrote to memory of 2812 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 32 PID 2848 wrote to memory of 2812 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 32 PID 2848 wrote to memory of 2812 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 32 PID 2848 wrote to memory of 2196 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 34 PID 2848 wrote to memory of 2196 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 34 PID 2848 wrote to memory of 2196 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 34 PID 2848 wrote to memory of 2196 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 34 PID 2848 wrote to memory of 1860 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 36 PID 2848 wrote to memory of 1860 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 36 PID 2848 wrote to memory of 1860 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 36 PID 2848 wrote to memory of 1860 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 36 PID 2848 wrote to memory of 1448 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 38 PID 2848 wrote to memory of 1448 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 38 PID 2848 wrote to memory of 1448 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 38 PID 2848 wrote to memory of 1448 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 38 PID 2848 wrote to memory of 2392 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 40 PID 2848 wrote to memory of 2392 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 40 PID 2848 wrote to memory of 2392 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 40 PID 2848 wrote to memory of 2392 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 40 PID 2848 wrote to memory of 2344 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 42 PID 2848 wrote to memory of 2344 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 42 PID 2848 wrote to memory of 2344 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 42 PID 2848 wrote to memory of 2344 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 42 PID 2848 wrote to memory of 2352 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 44 PID 2848 wrote to memory of 2352 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 44 PID 2848 wrote to memory of 2352 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 44 PID 2848 wrote to memory of 2352 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 44 PID 2848 wrote to memory of 924 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 46 PID 2848 wrote to memory of 924 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 46 PID 2848 wrote to memory of 924 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 46 PID 2848 wrote to memory of 924 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 46 PID 2848 wrote to memory of 1584 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 48 PID 2848 wrote to memory of 1584 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 48 PID 2848 wrote to memory of 1584 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 48 PID 2848 wrote to memory of 1584 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 48 PID 2848 wrote to memory of 1728 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 50 PID 2848 wrote to memory of 1728 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 50 PID 2848 wrote to memory of 1728 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 50 PID 2848 wrote to memory of 1728 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 50 PID 2848 wrote to memory of 1240 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 52 PID 2848 wrote to memory of 1240 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 52 PID 2848 wrote to memory of 1240 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 52 PID 2848 wrote to memory of 1240 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 52 PID 2848 wrote to memory of 3036 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 54 PID 2848 wrote to memory of 3036 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 54 PID 2848 wrote to memory of 3036 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 54 PID 2848 wrote to memory of 3036 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 54 PID 2848 wrote to memory of 3056 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 56 PID 2848 wrote to memory of 3056 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 56 PID 2848 wrote to memory of 3056 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 56 PID 2848 wrote to memory of 3056 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 56 PID 2848 wrote to memory of 2604 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 58 PID 2848 wrote to memory of 2604 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 58 PID 2848 wrote to memory of 2604 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 58 PID 2848 wrote to memory of 2604 2848 d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe"C:\Users\Admin\AppData\Local\Temp\d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1448
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2344
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"2⤵PID:2352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"2⤵PID:924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:1728
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:1240
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:3036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:3056
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1796
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:1804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:772
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2096
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:2628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2672
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2472
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2448
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:2336
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:1332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2160
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1644
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1052
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3048
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2268
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2600
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:3000
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"2⤵PID:1008
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1592
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2080
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:108
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2052
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2756
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2288
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2112
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2244
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"2⤵PID:2580
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"2⤵PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:2428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"2⤵PID:2436
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2492
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2816
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"2⤵PID:2156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2208
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1912
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2184
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2368
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2180
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1728
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1240
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:3048
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1740
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1244
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"2⤵PID:1124
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:2132
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2396
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"2⤵PID:1156
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:3012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1976
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:932
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2968
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:836
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2248
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:2096
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2624
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2672
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2424
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2520
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2416
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"2⤵PID:3024
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:1040
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2308
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1364
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2160
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2188
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:876
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"2⤵PID:2204
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"2⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2456
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2152
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:3000
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:1428
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:2760
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2996
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2992
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:2748
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:108
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:544
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"2⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:788
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2084
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2784
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2772
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"2⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2684
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2824
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2336
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2376
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2716
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2176
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:2192
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:924
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"2⤵PID:1584
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1224
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"2⤵PID:2796
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2340
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"2⤵PID:328
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:1944
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"2⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"2⤵PID:484
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1592
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:1776
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2324
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"2⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1296
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:2076
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:972
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:900
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2968
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2292
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:896
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2348
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2880
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2872
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2552
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2596
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2556
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2472
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2448
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:3024
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2300
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:1332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"2⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"2⤵PID:1572
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:1272
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2352
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:1644
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"2⤵PID:2204
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"2⤵PID:2200
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"2⤵PID:2044
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"2⤵PID:2804
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"2⤵PID:2268
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2168
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"2⤵PID:2128
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"2⤵PID:268
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"2⤵PID:800
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:648
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"2⤵PID:2768
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"2⤵PID:2388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"2⤵PID:3064
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"2⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"2⤵PID:320
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"2⤵PID:672
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:1864
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"2⤵PID:2744
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"2⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"2⤵PID:1528
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"2⤵PID:1588
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"2⤵PID:2936
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"2⤵PID:2620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1680
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2228
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2444
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:2496
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:2836
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2020
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1628
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1668
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1660
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2540
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"2⤵PID:332
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:1212
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"2⤵PID:1808
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"2⤵PID:856
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"2⤵PID:2476
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"2⤵PID:2908
-
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"2⤵PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe"C:\Users\Admin\AppData\Local\Temp\d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac
-
Filesize
6KB
MD53d2adaa3d221fda021e6c08d987bdaad
SHA12e4739d2d1bff8e4c093b913f3f4523ffc977cfa
SHA25628ad93c4a8d4357a13c17c615f21a2166984e2a438c1a1c1dd2e1c99d3640b16
SHA512294e84892356e2abfbb14f00ad4fd5457dd63a6740bfd0de3457f321eae7807d4b06d2fda81aad1bbf0af4d9188c332c0578f224550d82745bdff03dd370d0f4