Resubmissions
Analysis
-
max time kernel
102s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-es -
resource tags
arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
05-06-2024 14:30
Static task
static1
Behavioral task
behavioral1
Sample
7z2405-x64.exe
Resource
win10v2004-20240226-es
General
-
Target
7z2405-x64.exe
-
Size
1.5MB
-
MD5
c73433dd532d445d099385865f62148b
-
SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734
-
SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9
-
SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447
-
SSDEEP
49152:ZEVAbJqaITViU3qLkr7toP9KT+uv6WC+5uxe1o58:ZEVcqeUaki9oBqt+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4764 7zFM.exe 1592 7zG.exe -
Loads dropped DLL 1 IoCs
pid Process 1592 7zG.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2405-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2405-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{68C8BB9B-2745-4134-958C-C11915220930} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2405-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2405-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2405-x64.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3508 msedge.exe 3508 msedge.exe 3532 msedge.exe 3532 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4764 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 4764 7zFM.exe Token: 35 4764 7zFM.exe Token: SeRestorePrivilege 1592 7zG.exe Token: 35 1592 7zG.exe Token: SeSecurityPrivilege 1592 7zG.exe Token: SeSecurityPrivilege 1592 7zG.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4764 7zFM.exe 1592 7zG.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 1108 3532 msedge.exe 95 PID 3532 wrote to memory of 1108 3532 msedge.exe 95 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 2728 3532 msedge.exe 96 PID 3532 wrote to memory of 4068 3532 msedge.exe 97 PID 3532 wrote to memory of 4068 3532 msedge.exe 97 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98 PID 3532 wrote to memory of 1348 3532 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"1⤵
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6604 --field-trial-handle=2004,i,3518780201612530827,12523116488201166376,262144 --variations-seed-version /prefetch:81⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa1f2d2e98,0x7ffa1f2d2ea4,0x7ffa1f2d2eb02⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2064 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:22⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2352 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:32⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4664 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:82⤵PID:1960
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4764 -
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap1970:82:7zEvent9748 -ad -saa -- "C:\Users\Public\Desktop\ResizeImport_2"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD52537a4ba91cb5ad22293b506ad873500
SHA1ce3f4a90278206b33f037eaf664a5fbc39089ec4
SHA2565529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4
SHA5127c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14
-
Filesize
960KB
MD5b161d842906239bf2f32ad158bea57f1
SHA14a125d6cbeae9658e862c637aba8f8b9f3bf5cf7
SHA2563345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03
SHA5120d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c
-
Filesize
691KB
MD5ebff295ea5bb139eb04c699e1a52c286
SHA14d71053397304ab545f246ed6676d5927691b833
SHA256835d114678b311e938ee235519be252b38f14f2c5117d3ee3b905f09f0615f94
SHA5124320277436d737efb3ea04515a52ec86102a02f840b2f16d8f27673244124e149f01eee15870448710ec015c103a83f8bbf491f9928dbc1bc1b55236da8473b9
-
Filesize
10KB
MD554ce4d279862f4674c19b6901372208a
SHA13e27e163fc9f2f7a574bf6fafa926db4a937ebd1
SHA25685e1a8a9e7da2afc0444f6fa00d6814bd4e6bd038c00ce7edd8eea091ba2989d
SHA5125439859e4362a916c8438e9bd78e7bc57f00375f281d7d9625c00b337fac6d6f8743e9c6c794d533648915839d0ec913b212518759803431c0a5116e1fdc9187
-
Filesize
280B
MD54c07962c1ad5a7b1e2b079594e6367f8
SHA1b98bb2abad60387232002476205b4c30ce3bd160
SHA25669b564f95f428e132134fa472e3bc17fdf3a526370653d9d2e59a91c730e4c45
SHA512bf34124e0890a977c6e61cda5f2199dcb0e3f62fda916dc9af7039f18fcd1857e89208f88ae505691c1836af37c09b105fc14b6f18dfdd9db69c6152ae62e4b2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\524e436f-0f81-4ddd-b26c-80551f536a5b.tmp
Filesize9KB
MD5ffc1a448a603e1be125801b8e8fd2466
SHA1ebfddb120c17aefea403d8a18db69efd64ed4fdf
SHA256830282fb747fed64ba6938f9ce1dc739431d40695a052f706c15eea73c4f3d51
SHA512d640dfbd24aa11b520d1d5ce94b7dcf0980dc739ac5c7c1f9c15bc00a93e70b86a1ee88e9c79ffc53a8ca83d3dc30db79e54507807e6d25d4a26d18272bd8a56
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ab0d5f8-66c8-42c6-bd2f-9e7f1953f52b.tmp
Filesize40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
1KB
MD5126cc95a50fb094b5162d14940481fe7
SHA1e71b03a303934c6af83931d673147d8c9e996ff2
SHA2564a7596a124e4de1d57fe04781b58144c72a9e731252f068aef5cd16cfed9c901
SHA51224af0d7366f5c8e58fe206ad1b2293f46a755ddd05d629e3e0eb75cd473acf119475678df5a14d4ec418ed39458f0326008a7293bf9b22c02f85f41f57a8ed45
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
30KB
MD54547ef01c27148c4886122c88fa77328
SHA1326dc8207f62cd7b614f1f803982f1d7ac44ae7f
SHA2563e2781972cea270a08cf8985c5eb87a449d8e44ea4d08e16c2b8b6f5e23cf24e
SHA5121b1f9a73cc3798ccbaac0d50d73b6dbe0621c2a3a8341cffc7519197294a5501902d944053f3bb3e44e947cc145d3848d7c960574702cbfc5b350ec60e11dbb8
-
Filesize
33KB
MD5ff816cb8579bfcc1424d47b215e84cfe
SHA1146f4d93d79746c340761b670ad6a20e75829526
SHA2562b20305002f339dfc1abe526acb4245272afa33da46f21ad7bbd572e871c9a8a
SHA512afc68324cf3476506988a1dc11d720a8ebb36986a1648ac4c253de7a3bc7c47bd6a5a9806d48e6f2754aef12cb857aa64a29e32f263fa36d5058d71172f9862c
-
Filesize
42KB
MD5d6c0a14db904ecece6f8fbaa348ddf3c
SHA15222feef58083dd951ed74b565238f29c8f7d412
SHA256136fd8adb585a667ad08b30b3a7237a74b3a4194c4986a7ede93234104e4a0ef
SHA512b14670fb4de6de9557dbb705feb557d1b496be88dba279e9d7031f9b30e564dcbc23fa806cd2f568a26de12403540ba1cde311fa8c8604d9e37875c77b66a796