Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
700FAEE82AB...AD.exe
windows7-x64
1001D2E2B398...A9.exe
windows7-x64
100B760ABF10...23.exe
windows7-x64
100B8E9BC319...20.exe
windows7-x64
100D0E7D8626...E5.exe
windows7-x64
100E9765528C...69.exe
windows7-x64
100c9fa52ace...7a.exe
windows7-x64
715f7ea290d...8c.exe
windows7-x64
101CB8203982...26.exe
windows7-x64
101CF69170F7...5E.exe
windows7-x64
101CFEDCBA10...0E.exe
windows7-x64
71DD70E8036...25.exe
windows7-x64
101E229029B2...DA.exe
windows7-x64
101F5FEB3211...6D.exe
windows7-x64
101FD11B5CBB...ED.exe
windows7-x64
1021977fc851...61.exe
windows7-x64
1021e1bc4340...01.exe
windows7-x64
72C3542B5D9...85.exe
windows7-x64
73ac7f91e37...38.exe
windows7-x64
103c0fe521f6...16.exe
windows7-x64
1041c53e90f0...4a.exe
windows7-x64
10467c2b23b7...be.exe
windows7-x64
105b79b6a814...b0.exe
windows7-x64
10712affaa8b...1).exe
windows7-x64
18b04af13b7...21.exe
windows7-x64
10Analysis
-
max time kernel
1800s -
max time network
1808s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/07/2024, 19:21
Behavioral task
behavioral1
Sample
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
01D2E2B398D6017D5114464E39C40E9243AE492106CCA8B2D3EB1A95F9E228A9.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
0B760ABF108DB9BF5EA14F96A53F6D8E1B36FCC28BC75114E923482157B89A23.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
0D0E7D86268F7ACD51E9D4AC94F016034FB949B605B21405CBA0B5581E4532E5.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
0E9765528C4E8FDCFF83FA07A78F5E73B41B3D9295159C823FE3B1F97C113469.exe
Resource
win7-20240708-en
Behavioral task
behavioral7
Sample
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
1CB82039822CB89811F42B2C3BDBB4256D85D66E942CD69F38D3CB123596C926.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
1CF69170F7419E097EB71B514C01D2A028C95D0605F8B91C90A2E28B3216775E.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
1F5FEB3211A640804B3951DE9EA2037EFCB0D6EE1019D8853F98DAFD6132A76D.exe
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
1FD11B5CBB32F4CD5E7947F25E900BB4E59C1C5A21922F0A842EC62C20FAF2ED.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Resource
win7-20240705-en
Behavioral task
behavioral25
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240704-en
General
-
Target
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
-
Size
473KB
-
MD5
aadb6e0f1cc845e196570e800380fe85
-
SHA1
72b088cf546c36b6dda67cfb430874f83645397f
-
SHA256
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c
-
SHA512
55ba8c4734b9fb1c08b3c0be3c6c524a265aa1d3dc4a9f3a2f97f172c2913fc66ea7a002ad877d786e03db54b0a35f3244e9230c49fb30c6c6284404cffaf1b7
-
SSDEEP
6144:ULIaDW2Dm6jNkcZjvw6RQVe0yV4JMaT710E5BmutiO3XwGk/Rz+wLefC9rB6uN:XaiajeUjvw6RQHVJMau43XwG25NW4rd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2740 2676 mshta.exe 31 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Contacts a large (3341) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
description ioc Process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 55 IoCs
resource yara_rule behavioral8/memory/1908-1-0x0000000000400000-0x00000000004800B4-memory.dmp modiloader_stage2 behavioral8/memory/1908-2-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-5-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-6-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-3-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-4-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-7-0x0000000000400000-0x00000000004800B4-memory.dmp modiloader_stage2 behavioral8/memory/1908-8-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/1908-9-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/2532-16-0x0000000005D30000-0x0000000005E0C000-memory.dmp modiloader_stage2 behavioral8/memory/2980-17-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-20-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2532-19-0x0000000005D30000-0x0000000005E0C000-memory.dmp modiloader_stage2 behavioral8/memory/2980-22-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-25-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-30-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-35-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-34-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-33-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-32-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-31-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-29-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-28-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-36-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-41-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-49-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-54-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-48-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-47-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/1908-57-0x0000000001E30000-0x0000000001F0C000-memory.dmp modiloader_stage2 behavioral8/memory/2980-46-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-45-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-44-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-43-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-42-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-74-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-73-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-72-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-71-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-70-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-69-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-68-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-67-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-66-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-65-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-64-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2320-63-0x0000000000130000-0x000000000027A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-40-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-38-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-37-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-27-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-26-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-24-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-23-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 behavioral8/memory/2980-21-0x0000000000150000-0x000000000029A000-memory.dmp modiloader_stage2 -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
pid Process 2980 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\1e38\\1df6.bat\"" regsvr32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2532 set thread context of 2980 2532 powershell.exe 35 PID 2980 set thread context of 2320 2980 regsvr32.exe 36 PID 2980 set thread context of 552 2980 regsvr32.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\70cd\shell regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\70cd\shell\open regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\70cd\shell\open\command regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\70cd\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:K6OL5u=\"RyQ\";h9y=new ActiveXObject(\"WScript.Shell\");HwSp8E=\"H1x36\";Pn7H9j=h9y.RegRead(\"HKCU\\\\software\\\\ytun\\\\vjsdy\");co4sxMEd=\"dDxBA7qM\";eval(Pn7H9j);TFjr8Zn=\"hw\";\"" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.4407a regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.4407a\ = "70cd" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\70cd regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2532 powershell.exe 2532 powershell.exe 2532 powershell.exe 2532 powershell.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe 2980 regsvr32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2532 powershell.exe 2980 regsvr32.exe 2980 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2532 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2532 2740 mshta.exe 33 PID 2740 wrote to memory of 2532 2740 mshta.exe 33 PID 2740 wrote to memory of 2532 2740 mshta.exe 33 PID 2740 wrote to memory of 2532 2740 mshta.exe 33 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2532 wrote to memory of 2980 2532 powershell.exe 35 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 2320 2980 regsvr32.exe 36 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38 PID 2980 wrote to memory of 552 2980 regsvr32.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe"C:\Users\Admin\AppData\Local\Temp\15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe"1⤵PID:1908
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:xvc4Lf="XKB";c8B=new%20ActiveXObject("WScript.Shell");bU52Mp="S8KO9d2";Zqw4T=c8B.RegRead("HKCU\\software\\MbT4xfZHg\\YvWEperkW");zcFEd6="fKIkkxq";eval(Zqw4T);BhVKP3="hL";1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ywxeify2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵PID:2320
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵PID:552
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64B
MD51c9e72d731f5c121e6f6c97393964a33
SHA1539f396f83f13f16b2fa1c32c2284d4028496998
SHA2565e62f16dca0f2d56fe0ee602a2322b8d13cf012e61729b6c77d1eed4abbf6ad3
SHA512c3543caf65e8c92abcdc6e1b638d07e1c83189d8a45e0d75d3b319757f3a15519943ab89684c12d68709b861e880d1c8fef476519d46dd8e8feb4c276f3d6810
-
Filesize
7KB
MD5b7177f7256644a0a25b0b11780d897ed
SHA1a64e6deb3eac0eae2bdb0f39a416da7f95ac2538
SHA256625b7f0148bcc275147c2c7767264d34198e37caf383e9b8d8d951f308465400
SHA51202d6183d4204e5c6cf10d3e1315dcf9628f3b52a8d69e621c0dbcbf51fcbba731f1f4de23db581471e0ea9d98e2b746a08662101b238f234adc19fd91bb71bb8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\DT4F2KTM.htm
Filesize1KB
MD51bee6cfdca46274b96e3eddea0af129d
SHA1953c591fc7d396011f2e362de0811009c29306f4
SHA25674fc953c8af930fc86c885c3b2fb37936cdac9c56f950fec8f3fdab5bd12002e
SHA512ebd057ece641399f6aa979415afffd19d8528918cfec35cc3d16aaa2788e2f10fe01d6ce31463663713f9fd44baef68d2fa00d5687ea02a76d9b620e666933e6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b