Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 07:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1.zip
Resource
win10v2004-20240611-en
General
-
Target
https://github.com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1.zip
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3676 msedge.exe 3676 msedge.exe 3032 identity_helper.exe 3032 identity_helper.exe 1452 msedge.exe 1452 msedge.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6124 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 6124 taskmgr.exe Token: SeSystemProfilePrivilege 6124 taskmgr.exe Token: SeCreateGlobalPrivilege 6124 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe 6124 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 4708 3676 msedge.exe 83 PID 3676 wrote to memory of 4708 3676 msedge.exe 83 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 532 3676 msedge.exe 84 PID 3676 wrote to memory of 3152 3676 msedge.exe 85 PID 3676 wrote to memory of 3152 3676 msedge.exe 85 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86 PID 3676 wrote to memory of 1508 3676 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06e046f8,0x7ffa06e04708,0x7ffa06e047182⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5760 /prefetch:82⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3232 /prefetch:22⤵PID:4412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4760
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3844
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5192
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"1⤵PID:5624
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"1⤵PID:6032
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6124
-
C:\Windows\System32\-1hxuj.exe"C:\Windows\System32\-1hxuj.exe"1⤵PID:4008
-
C:\Windows\System32\-1hxuj.exe"C:\Windows\System32\-1hxuj.exe"1⤵PID:4816
-
C:\Windows\System32\-1hxuj.exe"C:\Windows\System32\-1hxuj.exe"1⤵PID:4904
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra.exe"1⤵PID:980
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:5596
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:2820
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:3996
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:5680
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:64
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:2308
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:3776
-
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"1⤵PID:5844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
Filesize
265B
MD5f5cd008cf465804d0e6f39a8d81f9a2d
SHA16b2907356472ed4a719e5675cc08969f30adc855
SHA256fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d
SHA512dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d
-
Filesize
6KB
MD5959ac946540e70494f5c9ed03273e3bb
SHA1c5ed92ee334cceb5791b35a7567166d9890bd1b2
SHA256c9d132db8e31d0d4e7cfb507f385656a22e236ef24390ece8d347e123ff69ccd
SHA512da49b62f9c9a6e6ed63e2bcd526bdd5edf55bf02f0ea88c9acde2e2d2b7b012a473889c356b8ced55b54f4646c719c42a67d63ff379b4165b87571e7833a45ea
-
Filesize
5KB
MD50d2034ba111427761392d70003b7819d
SHA137ac6b3550ac3f4cb1d504aa1c4192055b231bf7
SHA256ca888ace13ac502297007da60db8f1d8c84995a394e7b4353b5070a25eb5b53b
SHA5128bbab2586a0952729a6e4321164e946df7806a7f359eddce9cc6225f9fecc448d8660a167919bf97fe5fd47e1fb425b2a643a40e09577ba6880a22f7c7dadc08
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5bbb17dcc2615a6ffa9faef18c1c91c23
SHA160c24086a88d6a782df163142ba2193559be87f6
SHA2562cd2fe8c876055fffb33653233417f50917d38dc7d356d86502fed3ecfd6b9f6
SHA512d049af530956181c62aaae34f3c01958df7c31580c96e3449e92f0ff0c287ef271a61ddbc0ea647e7e145c2c1c8e621cd5f8a0f2c05ae38cbda7e0b88670aa06
-
Filesize
11KB
MD55845b74f03708fc931d8b3eb0f6ffcd2
SHA168c48db6757a5bcac174c86c4d41d46044cbe406
SHA2565c36fbded62edda9ea94e3acd5fe582614a98aa45742541684b45b90d29790a0
SHA5129bf6ac5fa7db77119a17fcd52e1140437104b680d4a21c2329c84d5efb8e755e56231b2ad888721d921c5299654ade4c9ba9ccb8e76343e08ff757c94336a751
-
Filesize
29.9MB
MD5eff9bb6ece503093bd38d32fb2b0505b
SHA1449e00124de04fbfb06b1b2138c5625143c67e86
SHA256aa87f77130862487c813d0ae1e60b60dec7874fc721c842beb2bee64951ce3d9
SHA51209d4b88da10d1fc891c780dceb9a8d9645149d6be29f4156fa9e29a7b3f4a18a07f344f58323be9b60eafada3785262e2a090a5510bc93be3f389ebde0bfb754