Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe
Resource
win10v2004-20240802-en
General
-
Target
5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe
-
Size
224KB
-
MD5
4c155e35d9d06d109f883480969df1d8
-
SHA1
1215567454951436d5df8499ea609cb7e4f084d4
-
SHA256
5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872
-
SHA512
fbf440b705628cb6023ea82eb9c19d3c86c4bcc9ca617f31e15defee1111ab1c265bbc89606fcdd0d0ec6daae1b2f38534ead0b34c7481eddda0215e1db60c56
-
SSDEEP
3072:Gl8KrIj6hCjG8G3GbGVGBGfGuGxGWYcrf6KadU:GlxrIj6AYcD6Kad
Malware Config
Signatures
-
Executes dropped EXE 62 IoCs
pid Process 2936 cgqod.exe 2844 rauce.exe 2916 hokid.exe 3024 moibu.exe 2576 duaaxoq.exe 1860 feodi.exe 1788 maoquv.exe 2464 jiafuy.exe 2572 lauuj.exe 1304 wuabe.exe 1764 saoinu.exe 2536 bauuye.exe 1984 vuoojew.exe 2508 vauuq.exe 2812 svriq.exe 2832 buafoo.exe 1744 koejuuh.exe 1128 laiiye.exe 2020 vuoojew.exe 2556 quigeew.exe 880 jiuuro.exe 2244 roaqu.exe 952 daooju.exe 2464 tdwom.exe 2972 xbvoil.exe 1540 nzqif.exe 328 seoohit.exe 1612 gearii.exe 2316 mauuje.exe 2672 maeezup.exe 2944 caoorif.exe 2740 nzqif.exe 2308 giawoo.exe 3064 daeevol.exe 2480 teasiy.exe 2064 muatoo.exe 1044 roemuup.exe 2656 boidu.exe 1480 ceuur.exe 1980 meaxii.exe 1280 deuuno.exe 2212 wuebaan.exe 2328 seoobit.exe 2192 hkyeoc.exe 2124 dgxoim.exe 1612 mauuj.exe 2692 qolet.exe 2304 diafuv.exe 2596 feodi.exe 2740 liejuuq.exe 3020 poemuur.exe 2312 geabot.exe 2072 pauuj.exe 2020 pauuj.exe 1384 miaguu.exe 2456 jokif.exe 992 zoemaah.exe 1848 kaosii.exe 916 miaguu.exe 1312 qoiizur.exe 2444 peodi.exe 2128 wuqol.exe -
Loads dropped DLL 64 IoCs
pid Process 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 2936 cgqod.exe 2936 cgqod.exe 2844 rauce.exe 2844 rauce.exe 2916 hokid.exe 2916 hokid.exe 3024 moibu.exe 3024 moibu.exe 2576 duaaxoq.exe 2576 duaaxoq.exe 1860 feodi.exe 1860 feodi.exe 1788 maoquv.exe 1788 maoquv.exe 2464 jiafuy.exe 2464 jiafuy.exe 2572 lauuj.exe 2572 lauuj.exe 1304 wuabe.exe 1304 wuabe.exe 1764 saoinu.exe 1764 saoinu.exe 2536 bauuye.exe 2536 bauuye.exe 1984 vuoojew.exe 1984 vuoojew.exe 2508 vauuq.exe 2508 vauuq.exe 2812 svriq.exe 2812 svriq.exe 2832 buafoo.exe 2832 buafoo.exe 1744 koejuuh.exe 1744 koejuuh.exe 1128 laiiye.exe 2020 vuoojew.exe 2020 vuoojew.exe 2556 quigeew.exe 2556 quigeew.exe 880 jiuuro.exe 880 jiuuro.exe 2244 roaqu.exe 2244 roaqu.exe 952 daooju.exe 952 daooju.exe 2464 tdwom.exe 2464 tdwom.exe 2972 xbvoil.exe 2972 xbvoil.exe 1540 nzqif.exe 1540 nzqif.exe 328 seoohit.exe 328 seoohit.exe 1612 gearii.exe 1612 gearii.exe 2316 mauuje.exe 2316 mauuje.exe 2672 maeezup.exe 2672 maeezup.exe 2944 caoorif.exe 2740 nzqif.exe 2740 nzqif.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 63 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language koejuuh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quigeew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgxoim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pauuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bauuye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hkyeoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoemaah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cgqod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caoorif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qoiizur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nzqif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuebaan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seoobit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jokif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language maoquv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language boidu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ceuur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mauuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poemuur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language miaguu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language peodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vauuq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language muatoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbvoil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language maeezup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vuoojew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roaqu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language giawoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language geabot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaosii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuqol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language laiiye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daooju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gearii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mauuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diafuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language feodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vuoojew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nzqif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language teasiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language liejuuq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language miaguu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rauce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language buafoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language roemuup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meaxii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hokid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language saoinu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jiuuro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdwom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daeevol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deuuno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qolet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pauuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duaaxoq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lauuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language feodi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svriq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seoohit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuabe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language moibu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jiafuy.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 2936 cgqod.exe 2844 rauce.exe 2916 hokid.exe 3024 moibu.exe 2576 duaaxoq.exe 1860 feodi.exe 1788 maoquv.exe 2464 jiafuy.exe 2572 lauuj.exe 1304 wuabe.exe 1764 saoinu.exe 2536 bauuye.exe 1984 vuoojew.exe 2508 vauuq.exe 2812 svriq.exe 2832 buafoo.exe 1744 koejuuh.exe 1128 laiiye.exe 2020 vuoojew.exe 2556 quigeew.exe 880 jiuuro.exe 2244 roaqu.exe 952 daooju.exe 2464 tdwom.exe 2972 xbvoil.exe 1540 nzqif.exe 328 seoohit.exe 1612 gearii.exe 2316 mauuje.exe 2672 maeezup.exe 2944 caoorif.exe 2740 nzqif.exe 2308 giawoo.exe 3064 daeevol.exe 2480 teasiy.exe 2064 muatoo.exe 1044 roemuup.exe 2656 boidu.exe 1480 ceuur.exe 1980 meaxii.exe 1280 deuuno.exe 2212 wuebaan.exe 2328 seoobit.exe 2192 hkyeoc.exe 2124 dgxoim.exe 1612 mauuj.exe 2692 qolet.exe 2304 diafuv.exe 2596 feodi.exe 2740 liejuuq.exe 3020 poemuur.exe 2312 geabot.exe 2072 pauuj.exe 2020 pauuj.exe 1384 miaguu.exe 2456 jokif.exe 992 zoemaah.exe 1848 kaosii.exe 916 miaguu.exe 1312 qoiizur.exe 2444 peodi.exe 2128 wuqol.exe -
Suspicious use of SetWindowsHookEx 63 IoCs
pid Process 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 2936 cgqod.exe 2844 rauce.exe 2916 hokid.exe 3024 moibu.exe 2576 duaaxoq.exe 1860 feodi.exe 1788 maoquv.exe 2464 jiafuy.exe 2572 lauuj.exe 1304 wuabe.exe 1764 saoinu.exe 2536 bauuye.exe 1984 vuoojew.exe 2508 vauuq.exe 2812 svriq.exe 2832 buafoo.exe 1744 koejuuh.exe 1128 laiiye.exe 2020 vuoojew.exe 2556 quigeew.exe 880 jiuuro.exe 2244 roaqu.exe 952 daooju.exe 2464 tdwom.exe 2972 xbvoil.exe 1540 nzqif.exe 328 seoohit.exe 1612 gearii.exe 2316 mauuje.exe 2672 maeezup.exe 2944 caoorif.exe 2740 nzqif.exe 2308 giawoo.exe 3064 daeevol.exe 2480 teasiy.exe 2064 muatoo.exe 1044 roemuup.exe 2656 boidu.exe 1480 ceuur.exe 1980 meaxii.exe 1280 deuuno.exe 2212 wuebaan.exe 2328 seoobit.exe 2192 hkyeoc.exe 2124 dgxoim.exe 1612 mauuj.exe 2692 qolet.exe 2304 diafuv.exe 2596 feodi.exe 2740 liejuuq.exe 3020 poemuur.exe 2312 geabot.exe 2072 pauuj.exe 2020 pauuj.exe 1384 miaguu.exe 2456 jokif.exe 992 zoemaah.exe 1848 kaosii.exe 916 miaguu.exe 1312 qoiizur.exe 2444 peodi.exe 2128 wuqol.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2936 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 31 PID 3048 wrote to memory of 2936 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 31 PID 3048 wrote to memory of 2936 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 31 PID 3048 wrote to memory of 2936 3048 5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe 31 PID 2936 wrote to memory of 2844 2936 cgqod.exe 32 PID 2936 wrote to memory of 2844 2936 cgqod.exe 32 PID 2936 wrote to memory of 2844 2936 cgqod.exe 32 PID 2936 wrote to memory of 2844 2936 cgqod.exe 32 PID 2844 wrote to memory of 2916 2844 rauce.exe 33 PID 2844 wrote to memory of 2916 2844 rauce.exe 33 PID 2844 wrote to memory of 2916 2844 rauce.exe 33 PID 2844 wrote to memory of 2916 2844 rauce.exe 33 PID 2916 wrote to memory of 3024 2916 hokid.exe 34 PID 2916 wrote to memory of 3024 2916 hokid.exe 34 PID 2916 wrote to memory of 3024 2916 hokid.exe 34 PID 2916 wrote to memory of 3024 2916 hokid.exe 34 PID 3024 wrote to memory of 2576 3024 moibu.exe 35 PID 3024 wrote to memory of 2576 3024 moibu.exe 35 PID 3024 wrote to memory of 2576 3024 moibu.exe 35 PID 3024 wrote to memory of 2576 3024 moibu.exe 35 PID 2576 wrote to memory of 1860 2576 duaaxoq.exe 36 PID 2576 wrote to memory of 1860 2576 duaaxoq.exe 36 PID 2576 wrote to memory of 1860 2576 duaaxoq.exe 36 PID 2576 wrote to memory of 1860 2576 duaaxoq.exe 36 PID 1860 wrote to memory of 1788 1860 feodi.exe 37 PID 1860 wrote to memory of 1788 1860 feodi.exe 37 PID 1860 wrote to memory of 1788 1860 feodi.exe 37 PID 1860 wrote to memory of 1788 1860 feodi.exe 37 PID 1788 wrote to memory of 2464 1788 maoquv.exe 38 PID 1788 wrote to memory of 2464 1788 maoquv.exe 38 PID 1788 wrote to memory of 2464 1788 maoquv.exe 38 PID 1788 wrote to memory of 2464 1788 maoquv.exe 38 PID 2464 wrote to memory of 2572 2464 jiafuy.exe 39 PID 2464 wrote to memory of 2572 2464 jiafuy.exe 39 PID 2464 wrote to memory of 2572 2464 jiafuy.exe 39 PID 2464 wrote to memory of 2572 2464 jiafuy.exe 39 PID 2572 wrote to memory of 1304 2572 lauuj.exe 40 PID 2572 wrote to memory of 1304 2572 lauuj.exe 40 PID 2572 wrote to memory of 1304 2572 lauuj.exe 40 PID 2572 wrote to memory of 1304 2572 lauuj.exe 40 PID 1304 wrote to memory of 1764 1304 wuabe.exe 41 PID 1304 wrote to memory of 1764 1304 wuabe.exe 41 PID 1304 wrote to memory of 1764 1304 wuabe.exe 41 PID 1304 wrote to memory of 1764 1304 wuabe.exe 41 PID 1764 wrote to memory of 2536 1764 saoinu.exe 42 PID 1764 wrote to memory of 2536 1764 saoinu.exe 42 PID 1764 wrote to memory of 2536 1764 saoinu.exe 42 PID 1764 wrote to memory of 2536 1764 saoinu.exe 42 PID 2536 wrote to memory of 1984 2536 bauuye.exe 43 PID 2536 wrote to memory of 1984 2536 bauuye.exe 43 PID 2536 wrote to memory of 1984 2536 bauuye.exe 43 PID 2536 wrote to memory of 1984 2536 bauuye.exe 43 PID 1984 wrote to memory of 2508 1984 vuoojew.exe 44 PID 1984 wrote to memory of 2508 1984 vuoojew.exe 44 PID 1984 wrote to memory of 2508 1984 vuoojew.exe 44 PID 1984 wrote to memory of 2508 1984 vuoojew.exe 44 PID 2508 wrote to memory of 2812 2508 vauuq.exe 45 PID 2508 wrote to memory of 2812 2508 vauuq.exe 45 PID 2508 wrote to memory of 2812 2508 vauuq.exe 45 PID 2508 wrote to memory of 2812 2508 vauuq.exe 45 PID 2812 wrote to memory of 2832 2812 svriq.exe 46 PID 2812 wrote to memory of 2832 2812 svriq.exe 46 PID 2812 wrote to memory of 2832 2812 svriq.exe 46 PID 2812 wrote to memory of 2832 2812 svriq.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe"C:\Users\Admin\AppData\Local\Temp\5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\cgqod.exe"C:\Users\Admin\cgqod.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\rauce.exe"C:\Users\Admin\rauce.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\hokid.exe"C:\Users\Admin\hokid.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\moibu.exe"C:\Users\Admin\moibu.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\duaaxoq.exe"C:\Users\Admin\duaaxoq.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\feodi.exe"C:\Users\Admin\feodi.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\maoquv.exe"C:\Users\Admin\maoquv.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\jiafuy.exe"C:\Users\Admin\jiafuy.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\lauuj.exe"C:\Users\Admin\lauuj.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\wuabe.exe"C:\Users\Admin\wuabe.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\saoinu.exe"C:\Users\Admin\saoinu.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\bauuye.exe"C:\Users\Admin\bauuye.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\vuoojew.exe"C:\Users\Admin\vuoojew.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\vauuq.exe"C:\Users\Admin\vauuq.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\svriq.exe"C:\Users\Admin\svriq.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\buafoo.exe"C:\Users\Admin\buafoo.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\Users\Admin\koejuuh.exe"C:\Users\Admin\koejuuh.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Users\Admin\laiiye.exe"C:\Users\Admin\laiiye.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1128 -
C:\Users\Admin\vuoojew.exe"C:\Users\Admin\vuoojew.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Users\Admin\quigeew.exe"C:\Users\Admin\quigeew.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2556 -
C:\Users\Admin\jiuuro.exe"C:\Users\Admin\jiuuro.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:880 -
C:\Users\Admin\roaqu.exe"C:\Users\Admin\roaqu.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2244 -
C:\Users\Admin\daooju.exe"C:\Users\Admin\daooju.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952 -
C:\Users\Admin\tdwom.exe"C:\Users\Admin\tdwom.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Users\Admin\xbvoil.exe"C:\Users\Admin\xbvoil.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2972 -
C:\Users\Admin\nzqif.exe"C:\Users\Admin\nzqif.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1540 -
C:\Users\Admin\seoohit.exe"C:\Users\Admin\seoohit.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:328 -
C:\Users\Admin\gearii.exe"C:\Users\Admin\gearii.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Users\Admin\mauuje.exe"C:\Users\Admin\mauuje.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Users\Admin\maeezup.exe"C:\Users\Admin\maeezup.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Users\Admin\caoorif.exe"C:\Users\Admin\caoorif.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2944 -
C:\Users\Admin\nzqif.exe"C:\Users\Admin\nzqif.exe"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\giawoo.exe"C:\Users\Admin\giawoo.exe"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2308 -
C:\Users\Admin\daeevol.exe"C:\Users\Admin\daeevol.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3064 -
C:\Users\Admin\teasiy.exe"C:\Users\Admin\teasiy.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2480 -
C:\Users\Admin\muatoo.exe"C:\Users\Admin\muatoo.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Users\Admin\roemuup.exe"C:\Users\Admin\roemuup.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Users\Admin\boidu.exe"C:\Users\Admin\boidu.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Users\Admin\ceuur.exe"C:\Users\Admin\ceuur.exe"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1480 -
C:\Users\Admin\meaxii.exe"C:\Users\Admin\meaxii.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Users\Admin\deuuno.exe"C:\Users\Admin\deuuno.exe"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\Users\Admin\wuebaan.exe"C:\Users\Admin\wuebaan.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2212 -
C:\Users\Admin\seoobit.exe"C:\Users\Admin\seoobit.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2328 -
C:\Users\Admin\hkyeoc.exe"C:\Users\Admin\hkyeoc.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192 -
C:\Users\Admin\dgxoim.exe"C:\Users\Admin\dgxoim.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124 -
C:\Users\Admin\mauuj.exe"C:\Users\Admin\mauuj.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Users\Admin\qolet.exe"C:\Users\Admin\qolet.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2692 -
C:\Users\Admin\diafuv.exe"C:\Users\Admin\diafuv.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Users\Admin\feodi.exe"C:\Users\Admin\feodi.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596 -
C:\Users\Admin\liejuuq.exe"C:\Users\Admin\liejuuq.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Users\Admin\poemuur.exe"C:\Users\Admin\poemuur.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3020 -
C:\Users\Admin\geabot.exe"C:\Users\Admin\geabot.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Users\Admin\pauuj.exe"C:\Users\Admin\pauuj.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Users\Admin\pauuj.exe"C:\Users\Admin\pauuj.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Users\Admin\miaguu.exe"C:\Users\Admin\miaguu.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1384 -
C:\Users\Admin\jokif.exe"C:\Users\Admin\jokif.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2456 -
C:\Users\Admin\zoemaah.exe"C:\Users\Admin\zoemaah.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:992 -
C:\Users\Admin\kaosii.exe"C:\Users\Admin\kaosii.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848 -
C:\Users\Admin\miaguu.exe"C:\Users\Admin\miaguu.exe"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Users\Admin\qoiizur.exe"C:\Users\Admin\qoiizur.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1312 -
C:\Users\Admin\peodi.exe"C:\Users\Admin\peodi.exe"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Users\Admin\wuqol.exe"C:\Users\Admin\wuqol.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD543f351c6e2004900a198c05d3518dde7
SHA17ec698932424a66e2abb329261b1888478194b8a
SHA256c034d9ce9fe2736b3d6765ab0178e0103f5e84ae32a2aeebd604e54d175ac92b
SHA512c16965e1798c8652068b699bf4807e6f74ed93714d6ca889cad575cf146203b86756a8e6e2ae43c589f81fbac9a6675076dae22e4a4502327b4a60d959859101
-
Filesize
224KB
MD5a3cecf50eb0ac6bab79bedb47c254eb1
SHA16316961a8017df1733a1317c01c643e9fdad562e
SHA256ffe2e23a71a088b42fea05205bf7092808f41375581a2ad579837860605425a9
SHA512c18034dc6696614ac22599ca8ced8caa3cb7620f82a86b2372409651a71a62d4621ac74c8ec058143e9bf2e71071d11dadd41453508e28bc8e4aa48db7fcd827
-
Filesize
224KB
MD590a5a71e0bfd5d51e2055b1053459837
SHA179574a325a87d109741db9ad1cf7f99c70aa6944
SHA256605f421c01a2318ffab827c1c94a31f4ac79dffa6443c8cfc71093a9530b3e55
SHA51211b2e9136649d743bd2755d55bb6402ecaf97b25cf4694531ed454bbab866b815074af0c72be33c449391673a90f7be95b16d3152e45954c23d6a78942b1d382
-
Filesize
224KB
MD51bd540634d8bc2960ebbe293733a2fa1
SHA1c2bff6492c3c0163a27a70640ba2af49bede6fcd
SHA2567806fbd7464866d37b81f9f025550939558c2ad1654ef081c7abe63a0f10b344
SHA512ec5923e46b8a3e05512fd214dcf1ea98dd78a7ecc162ce25a2f11c035271213d40ae0c2fd5c4131193393f8e3eb8e6e711520fdb4ab21a4e53a61fa14c84d8dc
-
Filesize
224KB
MD51ff539d276ab238baa15624f9268c14b
SHA18b1375ebb655b29c2dfe9b6ab1700d34d57447f9
SHA256690bdbe99ef02b98d644faf3a04649477f86640ea7043687276dd2a7a1cc19fe
SHA512ed0127175be06705590ff0dae56812119caa3f9cac3b98b87950ec12db11ce4ad61a736c82f7e2e3bac95de143e51011bdbc558480cca8e127279e37a200d8c2
-
Filesize
224KB
MD5c587c6cb2a4ba98aa5fa4b319880f4bd
SHA1938dd9a2c3f63b5cef0bafb863f947a53269f32a
SHA256edc45e13dabed1a6bdef18bd8c009c5692c074e96540c140e3095fe11343d4d7
SHA512d8644425425b61dcd705b4ef0923689b1c2d64099f3afc6d322b0c9da34834ce0c76314dbfff939a7adea138680c4564e85e1279b5831124a800571ec436a2e1
-
Filesize
224KB
MD5217f249ce131884aaa07d4073932e998
SHA1635b9db656c29f51026f669aa28f33e9a4dd5840
SHA256b094f46bdb2f75834e42817616a60b8890aad27697dfb9dfc56d6fe005d92725
SHA512a36b5c31ff5b2723c55f80e8fce77957765ac036fadc989ffda2dcea727329cac2eb2a74a3a9004e015e0e412ce4d4989bdd153896221ced7618ec7110453fcd
-
Filesize
224KB
MD5f17ca4614c1490cf85df063799c79846
SHA15a9b5ed6168fe518b3fd6bd52db6681796dbbf58
SHA256c260d02baedd31c38a825d6f3a2af5dfe038fd743711b0dc9d1b82aa025c4223
SHA512bf7f1121dfc3bd9a45e1930eb2c183f683886085ed9de88971b3a79608cf35d996ecc38e33ed358b4469042ce7d017ca67192fcc8f7ac62f3406e34db38a2238
-
Filesize
224KB
MD5d8412aab3f4e87b5c910a24d3efd63f2
SHA118742ff309e5f4625ce2df2d0a8d57aa6a56a94b
SHA256274d7d460abbedbe35c33d04f9762561079f84bb9e97f05dd5c0038e7cbf8e96
SHA5123d1242135ea812b6bbe20e49acf76dc85d5224d7cbe9a081c26d77c50aa2476cc3d0d53c7bde40f9b7ac4bbe8f7743d30338e09c9a05efd9cfaaf3576cd848c4
-
Filesize
224KB
MD5f54e117ee2b9a36fab622f0dd246db3d
SHA1f00d5dd6a78bec428e599de1545fd7c3ce902eee
SHA2567143a1b8ade093f4d869ea3c9446992e1f4664edd04b607e28bdd1f5e517cea7
SHA51257be80a25a7a5539fcbb06b41e76e776cb49cfb66dae50392520d91f47284ef2375669add9edd8f8d5c921900b344ae2b9183648607cb6a26079c8f784c7e263
-
Filesize
224KB
MD53ea193a813358ad3aeaab3d85accbb48
SHA135cd55f4284f564c25be25c56a6c589c5d062639
SHA2564ddae56cdc4555785b3f3de04548b6065e3fde4f8fa78766530d13db76a5485a
SHA512f14218a6b0b40dc801ef7dbe2c2a485e9e1e2aaec49d538ee677e0c7d1d2de9c714b925cef486af4b169042fb5aebc91b716edf2dec99754bfbb545d360e202e
-
Filesize
224KB
MD5d0eb56a4f8c10c93eea254749b0e9fee
SHA1c22cf3f64a0846e9a22d6955c33f8b233e7bc940
SHA256fb02b7a4ba58544341850c46e6a6317a3b4f89b37a63507ebb64378226fb2c0d
SHA5124b955d2dca7244d44f3bf037ccb9f3cb33a1fd0dcc498f1c12d5bfff7f2502a018a42590316db6ba14b2e33687d9dfffeec7f5c0cd20af3728e6d681cb05794f
-
Filesize
224KB
MD5abbdba1cb3cd38762e798b5ac159cf1d
SHA13b546a3c049c045ce5a777f788e8755971dbf9c6
SHA2569d54a984d85e2340e2abf3e0ce3b63677f858eb38ded216f2da4da6f8a5ef3d1
SHA512255ce6a03bff33fbf59bd6b76dea85ae073726c2b500ff6d577035b45a45766d67413bb9144830eebaaa7c408de3847ddf2eee23b42a05c0ebe101d6306e7111
-
Filesize
224KB
MD589aa7ee5a42d4ea0ea9cc4b20992e110
SHA1e9c58ea938874273089c812091297ea426813b41
SHA256d0ef118a5d03d82eb600532c405fe2a5b0a24d90419683332dcf089c79684386
SHA512d0d0f786417038f6ef1b6429158adaec9bb1b9e6b6c8db54c4e4de845770479362260669417b1e790b78ceae3812d9b1f66e0567131ef86c66ce8f91dbb12604
-
Filesize
224KB
MD5a690ebe7a6dfc8899bb63cd15907def9
SHA17e277c78d1461aaa302ad847c59941d643b6915c
SHA2560772e85cfaa5c6a211a8fef2346835d2b5d735de7a62c6bbc4eef980864986a7
SHA51295f6b32f17067c75601faffe5ad6e9e50f8f4993cd01be53d2a3e54c08e549c9babcba4b5c23b89f4580da9b298d51d22a1d617eeaf13fb2402d30eda4738b25
-
Filesize
224KB
MD5717433564cfa0d1f0300e90bf7d94df5
SHA15df6e1702317cd5420e3831f5f782deca2b93e7e
SHA256ca34cdad96bc45e1a63b15b1b9c923705bd84d7111c85178f4eba7b5c0f19811
SHA512457c9ac824ee3a38295238a84abbe3544fc912e62699a9179012a7639d5ab900e8b31af0f52b56f142f51e863d67cf3f6535c921eb62829eb0ab41eb1e5cf8c6