Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/07/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
Resource
win10v2004-20240709-en
General
-
Target
28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
-
Size
250KB
-
MD5
0b15ac611ffb409d42f1718635482256
-
SHA1
7f039e46b0a1ae613b64c45769405f197dba0ca3
-
SHA256
28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd
-
SHA512
7076f48ba765d5cd4550757e9a6697075ae7bb5419f8a614223a3fdb827f8e6b5b26267f22cea19ce0c9239b7b3b624021dbec0e7d30ee1c433f739dfd1eeab4
-
SSDEEP
6144:bLcou8zw6r/39IDG+tW6Ltc/gkHYYrguTEzI:/55TeDG+tla/g+YYrguTE0
Malware Config
Extracted
xenorat
45.66.231.63
Holid_rat_nd8859g
-
delay
60400
-
install_path
appdata
-
port
1243
-
startup_name
HDdisplay
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 5 IoCs
pid Process 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 2040 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 2800 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 4308 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 852 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 4796 set thread context of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 set thread context of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 set thread context of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 set thread context of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4368 set thread context of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 set thread context of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 set thread context of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 set thread context of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 1592 2120 WerFault.exe 82 1556 1132 WerFault.exe 84 1640 2800 WerFault.exe 93 4984 4308 WerFault.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3320 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Token: SeDebugPrivilege 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe Token: SeDebugPrivilege 1520 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 2120 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 82 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1132 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 84 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 1520 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 85 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 4796 wrote to memory of 976 4796 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 86 PID 976 wrote to memory of 4368 976 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 91 PID 976 wrote to memory of 4368 976 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 91 PID 976 wrote to memory of 4368 976 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 91 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2040 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 92 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 2800 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 93 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 4308 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 94 PID 4368 wrote to memory of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95 PID 4368 wrote to memory of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95 PID 4368 wrote to memory of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95 PID 4368 wrote to memory of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95 PID 4368 wrote to memory of 852 4368 28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe2⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 923⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe2⤵PID:1132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 923⤵
- Program crash
PID:1556
-
-
-
C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "HDdisplay" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA052.tmp" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3320
-
-
-
C:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Local\Temp\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2040
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe4⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 925⤵
- Program crash
PID:1640
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe4⤵
- Executes dropped EXE
PID:4308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 925⤵
- Program crash
PID:4984
-
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exeC:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:852
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1132 -ip 11321⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2120 -ip 21201⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2800 -ip 28001⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4308 -ip 43081⤵PID:4232
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe.log
Filesize706B
MD580305b9a250a27091f46fa147674ffb3
SHA181b485761494618e4c8bba9af56c29b2ea8e8a07
SHA256d9febc24cdfe2a616fff0e891fb055951aad00be6d57b0bc3cf8f4f643c5f6ae
SHA51252544d526e83ae2a71d63768457435dbe79843a76146f60b7e41ec7b53ddb620323592325e19d6776b92b7e1fbb8dc79db85e94a30d970f0983563456ccd7a19
-
Filesize
1KB
MD597eb16acf891872f91fc8443ea268319
SHA1986240717ab115f689fa101fef5e10bb154c9326
SHA2561a08a4968aca691c62656cbae75111bdc53d331d261988543d70cd3fbeb3f79a
SHA5125f7b541007c0be54413815927698f4d76b713bc1eeacc706f5b1f6ad22ab84865670d4d7a51575a3a0854e9a04ab124e85d6c0246c7bb2d4b22d292bf35330dc
-
C:\Users\Admin\AppData\Roaming\XenoManager\28d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd.exe
Filesize250KB
MD50b15ac611ffb409d42f1718635482256
SHA17f039e46b0a1ae613b64c45769405f197dba0ca3
SHA25628d20d7c697f7f5b07c70d64eb356f2cc6331b0477369d6ba6d5c35cd886f9cd
SHA5127076f48ba765d5cd4550757e9a6697075ae7bb5419f8a614223a3fdb827f8e6b5b26267f22cea19ce0c9239b7b3b624021dbec0e7d30ee1c433f739dfd1eeab4