Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
b2458109543e5db6179b4658f03854f0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2458109543e5db6179b4658f03854f0N.exe
Resource
win10v2004-20240709-en
General
-
Target
b2458109543e5db6179b4658f03854f0N.exe
-
Size
455KB
-
MD5
b2458109543e5db6179b4658f03854f0
-
SHA1
4584c509f78d102ddf35924fbdb539cc8dcb0099
-
SHA256
79d1ea072de1d36ca909179496d8a8cfba5c16106882e0e92da6b83a52b780e5
-
SHA512
08247f92fa5f8874c7dacf5a709290cba86ef72fcd3569119bb755285437b63c5cb3cda685b05cb2f42b8e89d45ca43051c8a58446b72c1db5e80b6565ed8307
-
SSDEEP
6144:aBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8ALpIh9jil:VpQD+mO5KWy/zrVbt4fcYr9U9jI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1836 LSASS.exe 2980 LSASS.exe -
Loads dropped DLL 2 IoCs
pid Process 1836 LSASS.exe 1836 LSASS.exe -
Adds Run key to start application 2 TTPs 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: LSASS.exe File opened (read-only) \??\P: LSASS.exe File opened (read-only) \??\T: LSASS.exe File opened (read-only) \??\U: LSASS.exe File opened (read-only) \??\X: LSASS.exe File opened (read-only) \??\Y: LSASS.exe File opened (read-only) \??\E: LSASS.exe File opened (read-only) \??\K: LSASS.exe File opened (read-only) \??\Q: LSASS.exe File opened (read-only) \??\R: LSASS.exe File opened (read-only) \??\V: LSASS.exe File opened (read-only) \??\H: LSASS.exe File opened (read-only) \??\I: LSASS.exe File opened (read-only) \??\J: LSASS.exe File opened (read-only) \??\O: LSASS.exe File opened (read-only) \??\G: LSASS.exe File opened (read-only) \??\N: LSASS.exe File opened (read-only) \??\S: LSASS.exe File opened (read-only) \??\W: LSASS.exe File opened (read-only) \??\Z: LSASS.exe File opened (read-only) \??\M: LSASS.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf LSASS.exe File opened for modification C:\autorun.inf LSASS.exe File created F:\autorun.inf LSASS.exe File opened for modification F:\autorun.inf LSASS.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\LSASS.exe b2458109543e5db6179b4658f03854f0N.exe File opened for modification C:\Windows\LSASS.exe LSASS.exe File created C:\Windows\LSASS.exe b2458109543e5db6179b4658f03854f0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1708 b2458109543e5db6179b4658f03854f0N.exe 1708 b2458109543e5db6179b4658f03854f0N.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 2980 LSASS.exe 2980 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe 1836 LSASS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1836 1708 b2458109543e5db6179b4658f03854f0N.exe 30 PID 1708 wrote to memory of 1836 1708 b2458109543e5db6179b4658f03854f0N.exe 30 PID 1708 wrote to memory of 1836 1708 b2458109543e5db6179b4658f03854f0N.exe 30 PID 1708 wrote to memory of 1836 1708 b2458109543e5db6179b4658f03854f0N.exe 30 PID 1836 wrote to memory of 2916 1836 LSASS.exe 31 PID 1836 wrote to memory of 2916 1836 LSASS.exe 31 PID 1836 wrote to memory of 2916 1836 LSASS.exe 31 PID 1836 wrote to memory of 2916 1836 LSASS.exe 31 PID 1836 wrote to memory of 2944 1836 LSASS.exe 32 PID 1836 wrote to memory of 2944 1836 LSASS.exe 32 PID 1836 wrote to memory of 2944 1836 LSASS.exe 32 PID 1836 wrote to memory of 2944 1836 LSASS.exe 32 PID 1836 wrote to memory of 2980 1836 LSASS.exe 35 PID 1836 wrote to memory of 2980 1836 LSASS.exe 35 PID 1836 wrote to memory of 2980 1836 LSASS.exe 35 PID 1836 wrote to memory of 2980 1836 LSASS.exe 35 PID 1836 wrote to memory of 2800 1836 LSASS.exe 36 PID 1836 wrote to memory of 2800 1836 LSASS.exe 36 PID 1836 wrote to memory of 2800 1836 LSASS.exe 36 PID 1836 wrote to memory of 2800 1836 LSASS.exe 36 PID 1836 wrote to memory of 2808 1836 LSASS.exe 37 PID 1836 wrote to memory of 2808 1836 LSASS.exe 37 PID 1836 wrote to memory of 2808 1836 LSASS.exe 37 PID 1836 wrote to memory of 2808 1836 LSASS.exe 37 PID 1836 wrote to memory of 2848 1836 LSASS.exe 41 PID 1836 wrote to memory of 2848 1836 LSASS.exe 41 PID 1836 wrote to memory of 2848 1836 LSASS.exe 41 PID 1836 wrote to memory of 2848 1836 LSASS.exe 41 PID 1836 wrote to memory of 3000 1836 LSASS.exe 42 PID 1836 wrote to memory of 3000 1836 LSASS.exe 42 PID 1836 wrote to memory of 3000 1836 LSASS.exe 42 PID 1836 wrote to memory of 3000 1836 LSASS.exe 42 PID 1836 wrote to memory of 1900 1836 LSASS.exe 45 PID 1836 wrote to memory of 1900 1836 LSASS.exe 45 PID 1836 wrote to memory of 1900 1836 LSASS.exe 45 PID 1836 wrote to memory of 1900 1836 LSASS.exe 45 PID 1836 wrote to memory of 2696 1836 LSASS.exe 46 PID 1836 wrote to memory of 2696 1836 LSASS.exe 46 PID 1836 wrote to memory of 2696 1836 LSASS.exe 46 PID 1836 wrote to memory of 2696 1836 LSASS.exe 46 PID 1836 wrote to memory of 3036 1836 LSASS.exe 49 PID 1836 wrote to memory of 3036 1836 LSASS.exe 49 PID 1836 wrote to memory of 3036 1836 LSASS.exe 49 PID 1836 wrote to memory of 3036 1836 LSASS.exe 49 PID 1836 wrote to memory of 2332 1836 LSASS.exe 50 PID 1836 wrote to memory of 2332 1836 LSASS.exe 50 PID 1836 wrote to memory of 2332 1836 LSASS.exe 50 PID 1836 wrote to memory of 2332 1836 LSASS.exe 50 PID 1836 wrote to memory of 332 1836 LSASS.exe 53 PID 1836 wrote to memory of 332 1836 LSASS.exe 53 PID 1836 wrote to memory of 332 1836 LSASS.exe 53 PID 1836 wrote to memory of 332 1836 LSASS.exe 53 PID 1836 wrote to memory of 2592 1836 LSASS.exe 54 PID 1836 wrote to memory of 2592 1836 LSASS.exe 54 PID 1836 wrote to memory of 2592 1836 LSASS.exe 54 PID 1836 wrote to memory of 2592 1836 LSASS.exe 54 PID 1836 wrote to memory of 2440 1836 LSASS.exe 57 PID 1836 wrote to memory of 2440 1836 LSASS.exe 57 PID 1836 wrote to memory of 2440 1836 LSASS.exe 57 PID 1836 wrote to memory of 2440 1836 LSASS.exe 57 PID 1836 wrote to memory of 612 1836 LSASS.exe 58 PID 1836 wrote to memory of 612 1836 LSASS.exe 58 PID 1836 wrote to memory of 612 1836 LSASS.exe 58 PID 1836 wrote to memory of 612 1836 LSASS.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2458109543e5db6179b4658f03854f0N.exe"C:\Users\Admin\AppData\Local\Temp\b2458109543e5db6179b4658f03854f0N.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\LSASS.exe"C:\Windows\LSASS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2916
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2944
-
-
C:\Users\Admin\LSASS.exe"C:\Users\Admin\LSASS.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2800
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2808
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2848
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:3000
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1900
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2696
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:3036
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2332
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:332
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2592
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2440
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:612
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1824
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1488
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1240
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1272
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1848
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1744
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2504
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2488
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2160
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1752
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1084
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:760
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2460
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1860
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2952
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2748
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2636
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:284
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1928
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2284
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2676
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2680
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2884
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1576
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:992
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2404
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1384
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1032
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2544
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:1740
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
PID:2164
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5e917ffbd2914569bf7434083cfd529ad
SHA1006fcdcbc533cffa9648c1b81f6bad41d26311b9
SHA25633d7d6efdf47191a53aa00f1cf8d5163d379b44a6a1852f49fff53ca0d26de3b
SHA5121d3057b69abf97583a72af7f4867cd838c0e6bd440bafc4d90e51faf81d2d660d37a615aa164ab166940f2a4c4334aaa2f56c5d17bcde623e72de8c0d6ca5c6f
-
Filesize
190B
MD5b1445c7f646c6ca9a7597791af38d575
SHA191efaf63fa1f7a51ee2f9b1c3b0f8932f15439ce
SHA256220517d50470c86d94020cebcd03af286898e65338f468dc5f860dc04af2c88e
SHA512533349278b6d186f0f3947681e90dcc7f617e146736798e6fc23e79d61610f1f7b2e4b4241b296884622fbd6b1cf73dc694a852e05bf4235da8ed40b70c5683f
-
Filesize
455KB
MD5a2486c20fca89b63407a9f70c00ea118
SHA1ba7d516df630ba63c255bf10b4a250c05c70fd04
SHA25613afb18029bc53e810eebd7c9aef25d930f861f540ca9794d5579c3486fcef06
SHA51218413dbf56064ae01648b5b48595b660ffd740918bf559cf8d836f155168cfef8371f51bc1d74a163aad4a383d615045428cffdeb3bf0dbe8796fb33ac942d69