Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
35s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
21/06/2024, 19:20
Behavioral task
behavioral1
Sample
Electron_V3.rar
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Electron V3/ElectronV3.exe
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Electron V3/bin/agree.txt
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Electron V3/scripts/Inf Yield.txt
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Electron V3/workspace/IY_FE.iy
Resource
win10-20240404-en
General
-
Target
Electron V3/ElectronV3.exe
-
Size
19.3MB
-
MD5
b0885502ec66d85a82d73b72f9ed80f5
-
SHA1
982595a8a4de3cfc69f9215e72ca24c55f92e465
-
SHA256
c4439a3aebb0225e9e56775ed819aa466883d456bb4e5a821e1124b767140b6d
-
SHA512
735720c116f90e3aaaa2beaaf826013fe6c168bb603f4c5132d3fa2959392a7ef4a52c971bf51f6d1479fa128f2a3308605cd03594c2736adcff09d87aac79f0
-
SSDEEP
196608:G8QCuxCmDAJediqShxWTMRHvUWvo3hxjno/w3iFCxHQbRpXFJf5Pc:oBShATMRHdgxro/w3uCxHQb1Jh
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 664 netsh.exe 2040 netsh.exe -
Loads dropped DLL 31 IoCs
pid Process 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe 2164 ElectronV3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000700000001ab0b-50.dat upx behavioral2/memory/2164-54-0x00007FFB84060000-0x00007FFB844C5000-memory.dmp upx behavioral2/files/0x000700000001aadd-56.dat upx behavioral2/memory/2164-62-0x00007FFB96C40000-0x00007FFB96C64000-memory.dmp upx behavioral2/files/0x000700000001ab05-61.dat upx behavioral2/files/0x000700000001aae7-83.dat upx behavioral2/files/0x000700000001aae6-82.dat upx behavioral2/files/0x000700000001aae5-81.dat upx behavioral2/files/0x000700000001aae4-80.dat upx behavioral2/files/0x000700000001aae3-79.dat upx behavioral2/files/0x000700000001aae2-78.dat upx behavioral2/files/0x000700000001aae1-77.dat upx behavioral2/files/0x000700000001aae0-76.dat upx behavioral2/files/0x000700000001aadf-75.dat upx behavioral2/files/0x000700000001aade-74.dat upx behavioral2/memory/2164-73-0x00007FFB96D20000-0x00007FFB96D2F000-memory.dmp upx behavioral2/files/0x000700000001aadc-72.dat upx behavioral2/files/0x000700000001aadb-71.dat upx behavioral2/files/0x000700000001aada-70.dat upx behavioral2/files/0x000700000001ab0e-69.dat upx behavioral2/files/0x000700000001ab0d-68.dat upx behavioral2/files/0x000700000001ab0c-67.dat upx behavioral2/files/0x000700000001ab09-66.dat upx behavioral2/files/0x000700000001ab06-65.dat upx behavioral2/files/0x000700000001ab04-64.dat upx behavioral2/memory/2164-85-0x00007FFB96C20000-0x00007FFB96C39000-memory.dmp upx behavioral2/memory/2164-87-0x00007FFB96C10000-0x00007FFB96C1D000-memory.dmp upx behavioral2/memory/2164-89-0x00007FFB96970000-0x00007FFB96989000-memory.dmp upx behavioral2/memory/2164-91-0x00007FFB96940000-0x00007FFB9696C000-memory.dmp upx behavioral2/memory/2164-93-0x00007FFB96920000-0x00007FFB9693E000-memory.dmp upx behavioral2/memory/2164-95-0x00007FFB92F30000-0x00007FFB9309D000-memory.dmp upx behavioral2/memory/2164-97-0x00007FFB967C0000-0x00007FFB967EE000-memory.dmp upx behavioral2/memory/2164-102-0x00007FFB93EA0000-0x00007FFB93F56000-memory.dmp upx behavioral2/memory/2164-105-0x00007FFB96C40000-0x00007FFB96C64000-memory.dmp upx behavioral2/memory/2164-104-0x00007FFB83CE0000-0x00007FFB84054000-memory.dmp upx behavioral2/memory/2164-101-0x00007FFB84060000-0x00007FFB844C5000-memory.dmp upx behavioral2/memory/2164-107-0x00007FFB932F0000-0x00007FFB93304000-memory.dmp upx behavioral2/memory/2164-110-0x00007FFB931A0000-0x00007FFB931B0000-memory.dmp upx behavioral2/memory/2164-109-0x00007FFB96C20000-0x00007FFB96C39000-memory.dmp upx behavioral2/files/0x000700000001ab08-111.dat upx behavioral2/memory/2164-113-0x00007FFB93180000-0x00007FFB93194000-memory.dmp upx behavioral2/memory/2164-116-0x00007FFB93160000-0x00007FFB93175000-memory.dmp upx behavioral2/memory/2164-115-0x00007FFB96970000-0x00007FFB96989000-memory.dmp upx behavioral2/memory/2164-119-0x00007FFB92CB0000-0x00007FFB92DC8000-memory.dmp upx behavioral2/memory/2164-118-0x00007FFB96940000-0x00007FFB9696C000-memory.dmp upx behavioral2/files/0x000700000001ab10-120.dat upx behavioral2/memory/2164-122-0x00007FFB96920000-0x00007FFB9693E000-memory.dmp upx behavioral2/memory/2164-123-0x00007FFB92F00000-0x00007FFB92F22000-memory.dmp upx behavioral2/files/0x000700000001aae9-124.dat upx behavioral2/memory/2164-127-0x00007FFB92F30000-0x00007FFB9309D000-memory.dmp upx behavioral2/memory/2164-128-0x00007FFB92EE0000-0x00007FFB92EF7000-memory.dmp upx behavioral2/files/0x000700000001aaeb-126.dat upx behavioral2/memory/2164-130-0x00007FFB967C0000-0x00007FFB967EE000-memory.dmp upx behavioral2/memory/2164-131-0x00007FFB92EC0000-0x00007FFB92ED9000-memory.dmp upx behavioral2/files/0x000700000001aaea-132.dat upx behavioral2/memory/2164-134-0x00007FFB93EA0000-0x00007FFB93F56000-memory.dmp upx behavioral2/files/0x000700000001aaec-135.dat upx behavioral2/files/0x000700000001ab03-141.dat upx behavioral2/memory/2164-140-0x00007FFB93150000-0x00007FFB9315A000-memory.dmp upx behavioral2/memory/2164-139-0x00007FFB92E70000-0x00007FFB92EB9000-memory.dmp upx behavioral2/memory/2164-146-0x00007FFB932F0000-0x00007FFB93304000-memory.dmp upx behavioral2/files/0x000700000001ab01-147.dat upx behavioral2/memory/2164-145-0x00007FFB92C90000-0x00007FFB92CAE000-memory.dmp upx behavioral2/memory/2164-144-0x00007FFB92E50000-0x00007FFB92E61000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 14 discord.com 15 discord.com 19 discord.com 11 discord.com 12 discord.com 13 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1360 cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1360 sc.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x000700000001ab11-166.dat pyinstaller -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 4672 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2620 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 5108 tasklist.exe 3904 tasklist.exe 3096 tasklist.exe 684 tasklist.exe 4272 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2212 ipconfig.exe 3492 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4676 systeminfo.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4728 WMIC.exe Token: SeSecurityPrivilege 4728 WMIC.exe Token: SeTakeOwnershipPrivilege 4728 WMIC.exe Token: SeLoadDriverPrivilege 4728 WMIC.exe Token: SeSystemProfilePrivilege 4728 WMIC.exe Token: SeSystemtimePrivilege 4728 WMIC.exe Token: SeProfSingleProcessPrivilege 4728 WMIC.exe Token: SeIncBasePriorityPrivilege 4728 WMIC.exe Token: SeCreatePagefilePrivilege 4728 WMIC.exe Token: SeBackupPrivilege 4728 WMIC.exe Token: SeRestorePrivilege 4728 WMIC.exe Token: SeShutdownPrivilege 4728 WMIC.exe Token: SeDebugPrivilege 4728 WMIC.exe Token: SeSystemEnvironmentPrivilege 4728 WMIC.exe Token: SeRemoteShutdownPrivilege 4728 WMIC.exe Token: SeUndockPrivilege 4728 WMIC.exe Token: SeManageVolumePrivilege 4728 WMIC.exe Token: 33 4728 WMIC.exe Token: 34 4728 WMIC.exe Token: 35 4728 WMIC.exe Token: 36 4728 WMIC.exe Token: SeIncreaseQuotaPrivilege 2620 WMIC.exe Token: SeSecurityPrivilege 2620 WMIC.exe Token: SeTakeOwnershipPrivilege 2620 WMIC.exe Token: SeLoadDriverPrivilege 2620 WMIC.exe Token: SeSystemProfilePrivilege 2620 WMIC.exe Token: SeSystemtimePrivilege 2620 WMIC.exe Token: SeProfSingleProcessPrivilege 2620 WMIC.exe Token: SeIncBasePriorityPrivilege 2620 WMIC.exe Token: SeCreatePagefilePrivilege 2620 WMIC.exe Token: SeBackupPrivilege 2620 WMIC.exe Token: SeRestorePrivilege 2620 WMIC.exe Token: SeShutdownPrivilege 2620 WMIC.exe Token: SeDebugPrivilege 2620 WMIC.exe Token: SeSystemEnvironmentPrivilege 2620 WMIC.exe Token: SeRemoteShutdownPrivilege 2620 WMIC.exe Token: SeUndockPrivilege 2620 WMIC.exe Token: SeManageVolumePrivilege 2620 WMIC.exe Token: 33 2620 WMIC.exe Token: 34 2620 WMIC.exe Token: 35 2620 WMIC.exe Token: 36 2620 WMIC.exe Token: SeDebugPrivilege 3096 tasklist.exe Token: SeIncreaseQuotaPrivilege 4728 WMIC.exe Token: SeSecurityPrivilege 4728 WMIC.exe Token: SeTakeOwnershipPrivilege 4728 WMIC.exe Token: SeLoadDriverPrivilege 4728 WMIC.exe Token: SeSystemProfilePrivilege 4728 WMIC.exe Token: SeSystemtimePrivilege 4728 WMIC.exe Token: SeProfSingleProcessPrivilege 4728 WMIC.exe Token: SeIncBasePriorityPrivilege 4728 WMIC.exe Token: SeCreatePagefilePrivilege 4728 WMIC.exe Token: SeBackupPrivilege 4728 WMIC.exe Token: SeRestorePrivilege 4728 WMIC.exe Token: SeShutdownPrivilege 4728 WMIC.exe Token: SeDebugPrivilege 4728 WMIC.exe Token: SeSystemEnvironmentPrivilege 4728 WMIC.exe Token: SeRemoteShutdownPrivilege 4728 WMIC.exe Token: SeUndockPrivilege 4728 WMIC.exe Token: SeManageVolumePrivilege 4728 WMIC.exe Token: 33 4728 WMIC.exe Token: 34 4728 WMIC.exe Token: 35 4728 WMIC.exe Token: 36 4728 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2164 1596 ElectronV3.exe 70 PID 1596 wrote to memory of 2164 1596 ElectronV3.exe 70 PID 2164 wrote to memory of 3808 2164 ElectronV3.exe 71 PID 2164 wrote to memory of 3808 2164 ElectronV3.exe 71 PID 2164 wrote to memory of 1256 2164 ElectronV3.exe 73 PID 2164 wrote to memory of 1256 2164 ElectronV3.exe 73 PID 2164 wrote to memory of 60 2164 ElectronV3.exe 74 PID 2164 wrote to memory of 60 2164 ElectronV3.exe 74 PID 2164 wrote to memory of 4720 2164 ElectronV3.exe 75 PID 2164 wrote to memory of 4720 2164 ElectronV3.exe 75 PID 2164 wrote to memory of 4316 2164 ElectronV3.exe 77 PID 2164 wrote to memory of 4316 2164 ElectronV3.exe 77 PID 1256 wrote to memory of 2620 1256 cmd.exe 81 PID 1256 wrote to memory of 2620 1256 cmd.exe 81 PID 60 wrote to memory of 4728 60 cmd.exe 82 PID 60 wrote to memory of 4728 60 cmd.exe 82 PID 4316 wrote to memory of 3096 4316 cmd.exe 83 PID 4316 wrote to memory of 3096 4316 cmd.exe 83 PID 2164 wrote to memory of 4716 2164 ElectronV3.exe 85 PID 2164 wrote to memory of 4716 2164 ElectronV3.exe 85 PID 4716 wrote to memory of 628 4716 cmd.exe 87 PID 4716 wrote to memory of 628 4716 cmd.exe 87 PID 2164 wrote to memory of 4952 2164 ElectronV3.exe 88 PID 2164 wrote to memory of 4952 2164 ElectronV3.exe 88 PID 2164 wrote to memory of 548 2164 ElectronV3.exe 89 PID 2164 wrote to memory of 548 2164 ElectronV3.exe 89 PID 4952 wrote to memory of 4840 4952 cmd.exe 92 PID 4952 wrote to memory of 4840 4952 cmd.exe 92 PID 548 wrote to memory of 684 548 cmd.exe 93 PID 548 wrote to memory of 684 548 cmd.exe 93 PID 2164 wrote to memory of 1360 2164 ElectronV3.exe 94 PID 2164 wrote to memory of 1360 2164 ElectronV3.exe 94 PID 1360 wrote to memory of 4616 1360 cmd.exe 96 PID 1360 wrote to memory of 4616 1360 cmd.exe 96 PID 2164 wrote to memory of 2424 2164 ElectronV3.exe 97 PID 2164 wrote to memory of 2424 2164 ElectronV3.exe 97 PID 2164 wrote to memory of 3648 2164 ElectronV3.exe 98 PID 2164 wrote to memory of 3648 2164 ElectronV3.exe 98 PID 3648 wrote to memory of 4272 3648 cmd.exe 101 PID 3648 wrote to memory of 4272 3648 cmd.exe 101 PID 2424 wrote to memory of 824 2424 cmd.exe 102 PID 2424 wrote to memory of 824 2424 cmd.exe 102 PID 2164 wrote to memory of 3824 2164 ElectronV3.exe 103 PID 2164 wrote to memory of 3824 2164 ElectronV3.exe 103 PID 2164 wrote to memory of 2648 2164 ElectronV3.exe 104 PID 2164 wrote to memory of 2648 2164 ElectronV3.exe 104 PID 2164 wrote to memory of 8 2164 ElectronV3.exe 105 PID 2164 wrote to memory of 8 2164 ElectronV3.exe 105 PID 2164 wrote to memory of 1408 2164 ElectronV3.exe 106 PID 2164 wrote to memory of 1408 2164 ElectronV3.exe 106 PID 2648 wrote to memory of 776 2648 cmd.exe 111 PID 2648 wrote to memory of 776 2648 cmd.exe 111 PID 3824 wrote to memory of 4364 3824 cmd.exe 112 PID 3824 wrote to memory of 4364 3824 cmd.exe 112 PID 8 wrote to memory of 5108 8 cmd.exe 113 PID 8 wrote to memory of 5108 8 cmd.exe 113 PID 1408 wrote to memory of 4268 1408 cmd.exe 114 PID 1408 wrote to memory of 4268 1408 cmd.exe 114 PID 776 wrote to memory of 1544 776 cmd.exe 115 PID 776 wrote to memory of 1544 776 cmd.exe 115 PID 4364 wrote to memory of 1864 4364 cmd.exe 116 PID 4364 wrote to memory of 1864 4364 cmd.exe 116 PID 2164 wrote to memory of 5028 2164 ElectronV3.exe 117 PID 2164 wrote to memory of 5028 2164 ElectronV3.exe 117 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4616 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:3808
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"3⤵PID:4720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer4⤵PID:628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"4⤵
- Views/modifies file attributes
PID:4616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"4⤵PID:824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:4272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\chcp.comchcp5⤵PID:1864
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\system32\chcp.comchcp5⤵PID:1544
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:5108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"3⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"3⤵PID:5028
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:4676
-
-
C:\Windows\system32\HOSTNAME.EXEhostname4⤵PID:2724
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername4⤵
- Collects information from the system
PID:4672
-
-
C:\Windows\system32\net.exenet user4⤵PID:3800
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user5⤵PID:1744
-
-
-
C:\Windows\system32\query.exequery user4⤵PID:4716
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵PID:3880
-
-
-
C:\Windows\system32\net.exenet localgroup4⤵PID:4400
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup5⤵PID:3136
-
-
-
C:\Windows\system32\net.exenet localgroup administrators4⤵PID:4832
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:4232
-
-
-
C:\Windows\system32\net.exenet user guest4⤵PID:3828
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest5⤵PID:3112
-
-
-
C:\Windows\system32\net.exenet user administrator4⤵PID:4200
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator5⤵PID:4824
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command4⤵PID:2616
-
-
C:\Windows\system32\tasklist.exetasklist /svc4⤵
- Enumerates processes with tasklist
PID:3904
-
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:2212
-
-
C:\Windows\system32\ROUTE.EXEroute print4⤵PID:3816
-
-
C:\Windows\system32\ARP.EXEarp -a4⤵PID:4616
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- Gathers network information
PID:3492
-
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
PID:1360
-
-
C:\Windows\system32\netsh.exenetsh firewall show state4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:664
-
-
C:\Windows\system32\netsh.exenetsh firewall show config4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵PID:4800
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:1780
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:3820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:2328
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:776
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.3MB
MD5b0885502ec66d85a82d73b72f9ed80f5
SHA1982595a8a4de3cfc69f9215e72ca24c55f92e465
SHA256c4439a3aebb0225e9e56775ed819aa466883d456bb4e5a821e1124b767140b6d
SHA512735720c116f90e3aaaa2beaaf826013fe6c168bb603f4c5132d3fa2959392a7ef4a52c971bf51f6d1479fa128f2a3308605cd03594c2736adcff09d87aac79f0
-
Filesize
94KB
MD511d9ac94e8cb17bd23dea89f8e757f18
SHA1d4fb80a512486821ad320c4fd67abcae63005158
SHA256e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
-
Filesize
31KB
MD5480d3f4496e16d54bb5313d206164134
SHA13db3a9f21be88e0b759855bf4f937d0bbfdf1734
SHA256568fb5c3d9b170ce1081ad12818b9a12f44ab1577449425a3ef30c2efbee613d
SHA5128e887e8de9c31dbb6d0a85b4d6d4157e917707e63ce5f119bb4b03cb28d41af90d087e3843f3a4c2509bca70cdac3941e00b8a5144ade8532a97166a5d0a7bd9
-
Filesize
43KB
MD539b487c3e69816bd473e93653dbd9b7f
SHA1bdce6fde092a3f421193ddb65df893c40542a4e2
SHA256a1629c455be2cf55e36021704716f4b16a96330fe993aae9e818f67c4026fcdc
SHA5127543c1555e8897d15c952b89427e7d06c32e250223e85fafae570f8a0fa13c39fb6fc322d043324a31b2f2f08d2f36e0da59dfd741d09c035d0429173b6badc9
-
Filesize
71KB
MD5641e49ce0c4fa963d347fbf915aabdbe
SHA11351f6c4ac5dcda7e3ffbf3d5e355b4bb864eb10
SHA2561c795df278c7f64be8e6973f8dbf1a625997cb39ae2dcb5bee0ca4c1b90c8906
SHA512766b9adb5143e89d663177c2fb0e951afb84c0a43ec690ae2c477ee0bbe036df6f4161a6012430d42e4913fd5fbe7e49af6d13ac7c62d042a484861fc5a04616
-
Filesize
53KB
MD5b1f12f4bfc0bd49a6646a0786bc5bc00
SHA1acb7d8c665bb8ca93e5f21e178870e3d141d7cbc
SHA2561fe61645ed626fc1dec56b2e90e8e551066a7ff86edbd67b41cb92211358f3d7
SHA512a3fb041bd122638873c395b95f1a541007123f271572a8a988c9d01d2b2d7bb20d70e1d97fc3abffd28cb704990b41d8984974c344faea98dd0c6b07472b5731
-
Filesize
101KB
MD5b7f498da5aec35140a6d928a8f792911
SHA195ab794a2d4cb8074a23d84b10cd62f7d12a4cd0
SHA256b15f0dc3ce6955336162c9428077dcedfa1c52e60296251521819f3239c26ee8
SHA5125fcb2d5325a6a4b7aff047091957ba7f13de548c5330f0149682d44140ac0af06837465871c598db71830fd3b2958220f80ae8744ef16fdb7336b3d6a5039e18
-
Filesize
30KB
MD531dfa2caaee02cc38adf4897b192d6d1
SHA19be57a9bad1cb420675f5b9e04c48b76d18f4a19
SHA256dc045ac7d4bde60b0f122d307fcd2bbaf5e1261a280c4fb67cfc43de5c0c2a0f
SHA5123e58c083e1e3201a9fbbf6a4fcbc2b0273cf22badabab8701b10b3f8fdd20b11758cdcfead557420393948434e340aad751a4c7aa740097ab29d1773ea3a0100
-
Filesize
81KB
MD595badb08cd77e563c9753fadc39a34dd
SHA1b3c3dfe64e89b5e7afb5f064bbf9d8d458f626a0
SHA2565545627b465d780b6107680922ef44144a22939dd406deae44858b79747e301a
SHA512eb36934b73f36ba2162e75f0866435f57088777dc40379f766366c26d40f185de5be3da55d17f5b82cb498025d8d90bc16152900502eb7f5de88bbef84ace2cf
-
Filesize
22KB
MD528f6fcc0b7bb10a45ff1370c9e1b9561
SHA1c7669f406b5ec2306a402e872dec17380219907a
SHA2566dd33d49554ee61490725ea2c9129c15544791ab7a65fb523cc9b4f88d38744b
SHA5122aef40344e80c3518afc07bf6ad4c96c4fff44434f8307e2efa544290d59504d7b014d7ea94af0377e342a632d6c4c74bfdf16d26f92ccc7062be618ea4dbee7
-
Filesize
27KB
MD5745706ab482fe9c9f92383292f121072
SHA1439f00978795d0845aceaf007fd76ff5947567fd
SHA2564d98e7d1b74bd209f8c66e1a276f60b470f6a5d6f519f76a91eb75be157a903d
SHA51252fe3dfc45c380dfb1d9b6e453bdffcd92d57ad7b7312d0b9a86a76d437c512a17da33822f8e81760710d8ff4fd6a4b702d2abfffc600c9350d4d463451d38d6
-
Filesize
21KB
MD518b8b2b0aefcee9527299c464b7f6d3d
SHA1a565216faee2534bbda5b3f65aeb2eef5fd9bcda
SHA2566f334fa1474116dd499a125f3b5ca4cd698039446faf50340f9a3f7af3adb8c2
SHA5120b56e9d89f4dd3da830954b6561c49c06775854e0b27bc2b07ea8e9c79829d66dae186b95209c8c4cc7c3a7ba6b03cdf134b2e0036cea929e61d755d4709abcb
-
Filesize
38KB
MD5f675cf3cdd836cacfab9c89ab9f97108
SHA13e077bf518f7a4cb30ea4607338cff025d4d476e
SHA256bb82a23d8dc6bf4c9aeb91d3f3bef069276ae3b14eeca100b988b85dd21e2dd3
SHA512e2344b5f59bd0fad3570977edf0505aa2e05618e66d07c9f93b163fc151c4e1d6fbc0e25b7c989505c1270f8cd4840c6120a73a7ad64591ee3c4fb282375465e
-
Filesize
45KB
MD51dbec8753e5cd062cd71a8bb294f28f9
SHA1c32e9b577f588408a732047863e04a1db6ca231e
SHA2566d95d41a36b5c9e3a895eff91149978aa383b6a8617d542accef2080737c3cad
SHA512a1c95dbb1a9e2ffbcc9422f53780b35fbc77cb56ac3562afb8753161a233e5efa8da8ad67f5bde5a094beb8331d9dab5c3d5e673a8d09fd6d0383a8a6ffda087
-
Filesize
57KB
MD52edf5c4e534a45966a68033e7395f40d
SHA1478ef27474eec0fd966d1663d2397e8fb47fec17
SHA2567abc2b326f5b7c3011827eb7a5a4d896cc6b2619246826519b3f57d2bb99d3bd
SHA512f83b698cfe702a15eb0267f254c593b90fa155ad2aefe75e5ba0ee5d4f38976882796cba2a027b42a910f244360177ac809891d505b3d0ae9276156b64850b6b
-
Filesize
18KB
MD5b3e7fc44f12d2db5bad6922e0b1d927f
SHA13fe8ef4b6fb0bc590a1c0c0f5710453e8e340f8f
SHA2566b93290a74fb288489405044a7dee7cca7c25fa854be9112427930dd739ebace
SHA512a0465a38aaac2d501e9a12a67d5d71c9eeeb425f535c473fc27ac13c2bb307641cc3cef540472f916e341d7bada80a84b99d78850d94c95ee14139f8540d0c42
-
Filesize
26KB
MD59957581b89a8a0c1fa8f10ed03faf862
SHA18a38fede27a2990d5ce9aa1e3664aa5617da1f32
SHA256fbb576e7c8b4a96fa41dc629a336650a4362e61092423e977596c266dc23983f
SHA512195566707019c8efdd8a11ebf3dfe30cf67f6d62cb2ca103d98a4ffca8574cc5df6d83b78ad891f369ea4318d1e7fc9466b1c17fb9cfea61a16960e9a2b26dcd
-
Filesize
78KB
MD54c47cc586ff34eb1e8ff5304de05cbfa
SHA1dea8568ac69a6d75a2ed0cb96228f113ed55f364
SHA2565a1f5f3b5c813c03821377b5ba3c5b3139de8a69415736fb2d8a022ef7160b30
SHA51241a90bec5258047e10ced50195abae182f560fd118742e86a340eda54ae3ff4f031805763366a7c4e7e0944669691271432b9b3edc0cdb3f2851d27bee5608c4
-
Filesize
24KB
MD529e8136c3e5f76cad4920b6af598a750
SHA104150e81d15700592654999e18a9ab956c5694fb
SHA256efbac999cb548957e7fe424b15a4edc98a8544689b87cd8159f26dc25224d83c
SHA512e7fe7ba7e457321bcdb226202fcaffe0cb95582354a592240d3b776b9f5663a94e38f9cf4f450102a5423fb0d238a0cb02e44c49dcddad45dbcbb9b714541827
-
Filesize
19KB
MD5af4bb56d74abb4de5f9fb4b91e16a017
SHA1f83fa1b0c60afd5f6ab5be9e456cc6670b99361c
SHA2565ecc8c1abf0dd9bb2449001ada615661923cf33e61dec1afbbc25bb1a353b3a4
SHA512e3d9b4f61486e1aa0da84cdc7d3f065ee247d67e08da2392cbbbce4fbafb3e026f65c9a2a024423ea853d9f6a22b7c8ee64e4c433a1633ea7250c88fcb4b0603
-
Filesize
858KB
MD57b2903144d2ab90e0e8c34c0c5fc8b30
SHA14f435ff09b472607c96c9fbc38ca1cac8cb4725c
SHA25676f8cfff0ca0997ba4fead6d7883316f32688cb9872a86df23148cd94c1511b2
SHA512257ed12db69532081c3b6050779b021e46dcc26377d69310a2352eecb285ed74cb9ca63f3dbfb9e9c2289c6add588a1512b7f0ae547952b6d4b578953dc36701
-
Filesize
2.0MB
MD5ee6736b4d99a613cdbf50416c7d12146
SHA1adf884880497c13475f681b1366b5739463e434e
SHA2564314c19d6c9042d26e8d31ef6b415ae1887cf551c0c1eddc0048852d70d160ee
SHA512a4bf39451e23c70eae5c4892a1f69d8b52591a1fbd61cb727a4e000002474a0ffaf7a94a0839dfb48bef201f93d3615481405419a55321bd44b58de4ac4f0b11
-
Filesize
36KB
MD56106b4d1eec11d2a71def28d2a2afa46
SHA1e10039eff42f88a2cd8dfe11d428c35f6178c6ce
SHA25619b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da
SHA512d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43
-
Filesize
1.1MB
MD5700f32459dca0f54c982cd1c1ddd6b8b
SHA12538711c091ac3f572cb0f13539a68df0f228f28
SHA2561de22bd1a0154d49f48b3fab94fb1fb1abd8bfed37d18e79a86ecd7cdab893c9
SHA51299de1f5cb78c83fc6af0a475fb556f1ac58a1ba734efc69d507bf5dc1b0535a401d901324be845d7a59db021f8967cf33a7b105b2ddcb2e02a39dc0311e7c36d
-
Filesize
23KB
MD5d50ebf567149ead9d88933561cb87d09
SHA1171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA2566aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA5127bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de
-
Filesize
198KB
MD545498cefc9ead03a63c2822581cd11c6
SHA1f96b6373237317e606b3715705a71db47e2cafad
SHA256a84174a00dc98c98240ad5ee16c35e6ef932cebd5b8048ff418d3dd80f20deca
SHA5124d3d8d33e7f3c2bf1cad3afbfba6ba53852d1314713ad60eeae1d51cc299a52b73da2c629273f9e0b7983ca01544c3645451cfa247911af4f81ca88a82cf6a80
-
Filesize
20KB
MD558a0ff76a0d7d3cd86ceb599d247c612
SHA1af52bdb9556ef4b9d38cf0f0b9283494daa556a6
SHA2562079d8be068f67fb2ece4fb3f5927c91c1c25edecb9d1c480829eb1cd21d7cc5
SHA512e2d4f80cdeba2f5749a4d3de542e09866055d8aee1d308b96cb61bc53f4495c781e9b2559cc6a5f160be96b307539a8b6e06cabeffcc0ddb9ad4107dcacd8a76
-
Filesize
81KB
MD5b4cf065f5e5b7a5bc2dd2b2e09bea305
SHA1d289a500ffd399053767ee7339e48c161655b532
SHA2569b5f407a2a1feaa76c6d3058a2f04c023b1c50b31d417bbfee69024098e4938b
SHA512ddd9e216b11152d6a50481e06bb409335d36ce7fe63072aa0c7789c541593f2d7e8b4373be67a018c59f5e418e5a39a3ad729b732f11fa253f6275a64e125989
-
Filesize
60KB
MD5a5471f05fd616b0f8e582211ea470a15
SHA1cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e
SHA2568d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
SHA512e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff
-
Filesize
1.4MB
MD590d5b8ba675bbb23f01048712813c746
SHA1f2906160f9fc2fa719fea7d37e145156742ea8a7
SHA2563a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e
SHA512872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e
-
Filesize
21KB
MD5740424368fb6339d67941015e7ac4096
SHA164f3fab24f469a027ddfcf0329eca121f4164e45
SHA256a389eae40188282c91e0cdf38c79819f475375860225b6963deb11623485b76d
SHA5126d17dc3f294f245b4ca2eca8e62f4c070c7b8a5325349bc25ebaeea291a5a5ebd268bd1321c08755141aa58de0f985adc67335b4f83bc1aeec4b398d0f538e0e
-
Filesize
605KB
MD57055e9008e847cb6015b1bb89f26c7ac
SHA1c7c844cb46f8287a88bec3bd5d02647f5a07ae80
SHA2562884d8e9007461ab6e8bbdd37c6bc4f6de472bbd52ec5b53e0a635075d86b871
SHA512651b7b8c2518e4826d84c89be5052fd944f58f558c51cc905da181049850186d0a87fd2e05734fbe6a69618a6e48261a9fdd043ab17eb01620c6510e96d57008
-
Filesize
285KB
MD50c26e9925bea49d7cf03cfc371283a9b
SHA189290d3e43e18165cb07a7a4f99855b9e8466b21
SHA25613c2ea04a1d40588536f1d7027c8d0ea228a9fb328ca720d6c53b96a8e1ae724
SHA5126a3cd4b48f7c0087f4a1bdc1241df71d56bd90226759481f17f56baa1b991d1af0ba5798a2b7ba57d9ffa9ec03a12bfac81df2fba88765bd369435ff21a941e1
-
Filesize
40KB
MD5c14493cd3cc9b9b5f850b5fadcbe936e
SHA1eddb260ff89bfa132a479fdf783c67098011fb85
SHA2561782f3c12b3eb01716fcd59b0cd69c02c2fb888db4377f4d5fe00f07986be8e3
SHA5120a7b85322b8fa566fb3d24b8e4021fb64433be06c3c4dbeb06d9633e4af0a5b76252fb2228de0abd818be5f4a18fffc712c727816632dd8c8585c9a9a7bf0fb6
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a