Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 19:10
Behavioral task
behavioral1
Sample
dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe
-
Size
93KB
-
MD5
cda76c5daf293a188eb6d41fb9d989ca
-
SHA1
d84c12c503c5075d6b132036753294dda0e1c400
-
SHA256
dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae
-
SHA512
902caf0767009dfa3f2fd24941aa19cf905eb5f7a418e431060494e49b561c4f88da315bb97bcfd3aa1d50145f38a5f63eeae444b078eb690c545eb216e11f08
-
SSDEEP
768:9Y3Q5yD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3+sGS:P5IOx6baIa9RZj00ljEwzGi1dDaDcgS
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3012 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\34d9934b339c8c0450a472268227412eWindows Update.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\34d9934b339c8c0450a472268227412eWindows Update.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Executes dropped EXE 2 IoCs
pid Process 2168 StUpdate.exe 2928 StUpdate.exe -
Loads dropped DLL 6 IoCs
pid Process 2168 StUpdate.exe 2168 StUpdate.exe 2168 StUpdate.exe 2928 StUpdate.exe 2928 StUpdate.exe 2928 StUpdate.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File created F:\autorun.inf dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File opened for modification F:\autorun.inf dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File created C:\autorun.inf dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Explower.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe File opened for modification C:\Windows\SysWOW64\Explower.exe dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: 33 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe Token: SeIncBasePriorityPrivilege 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3012 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 30 PID 2380 wrote to memory of 3012 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 30 PID 2380 wrote to memory of 3012 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 30 PID 2380 wrote to memory of 3012 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 30 PID 2380 wrote to memory of 2844 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 32 PID 2380 wrote to memory of 2844 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 32 PID 2380 wrote to memory of 2844 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 32 PID 2380 wrote to memory of 2844 2380 dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe 32 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2168 2280 taskeng.exe 35 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36 PID 2280 wrote to memory of 2928 2280 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe"C:\Users\Admin\AppData\Local\Temp\dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe" "dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3012
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:2844
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0427C0CF-1F82-4A91-B55D-41D20A81CDF6} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5cda76c5daf293a188eb6d41fb9d989ca
SHA1d84c12c503c5075d6b132036753294dda0e1c400
SHA256dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae
SHA512902caf0767009dfa3f2fd24941aa19cf905eb5f7a418e431060494e49b561c4f88da315bb97bcfd3aa1d50145f38a5f63eeae444b078eb690c545eb216e11f08
-
Filesize
5B
MD553ce6d1ae8885b5d12e654469f456c83
SHA19d8b30c523ddef4d24134072b27716bec7d94d6f
SHA256d7ebf92ad6e3bc44fbc3cfbb234ef4afafd7ea339f712229641a2849b6f87ce2
SHA512c15df9281e9ccbb8d30e24e751b77a030e734f8cda4bd9482d3ca02f6b23e463a8e90ddd78a582ca059e57b8d0492c22583d792bc7368094ffc06e12cd145d9d