Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 22:04

General

  • Target

    5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe

  • Size

    224KB

  • MD5

    4c155e35d9d06d109f883480969df1d8

  • SHA1

    1215567454951436d5df8499ea609cb7e4f084d4

  • SHA256

    5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872

  • SHA512

    fbf440b705628cb6023ea82eb9c19d3c86c4bcc9ca617f31e15defee1111ab1c265bbc89606fcdd0d0ec6daae1b2f38534ead0b34c7481eddda0215e1db60c56

  • SSDEEP

    3072:Gl8KrIj6hCjG8G3GbGVGBGfGuGxGWYcrf6KadU:GlxrIj6AYcD6Kad

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of SetWindowsHookEx 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe
    "C:\Users\Admin\AppData\Local\Temp\5ac179b303b2fd7389312cbcacb558a0c892ef6975b790aa4ed3151a29166872.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\cgqod.exe
      "C:\Users\Admin\cgqod.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\rauce.exe
        "C:\Users\Admin\rauce.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Users\Admin\hokid.exe
          "C:\Users\Admin\hokid.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\Users\Admin\moibu.exe
            "C:\Users\Admin\moibu.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3024
            • C:\Users\Admin\duaaxoq.exe
              "C:\Users\Admin\duaaxoq.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2576
              • C:\Users\Admin\feodi.exe
                "C:\Users\Admin\feodi.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1860
                • C:\Users\Admin\maoquv.exe
                  "C:\Users\Admin\maoquv.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1788
                  • C:\Users\Admin\jiafuy.exe
                    "C:\Users\Admin\jiafuy.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2464
                    • C:\Users\Admin\lauuj.exe
                      "C:\Users\Admin\lauuj.exe"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2572
                      • C:\Users\Admin\wuabe.exe
                        "C:\Users\Admin\wuabe.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1304
                        • C:\Users\Admin\saoinu.exe
                          "C:\Users\Admin\saoinu.exe"
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1764
                          • C:\Users\Admin\bauuye.exe
                            "C:\Users\Admin\bauuye.exe"
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2536
                            • C:\Users\Admin\vuoojew.exe
                              "C:\Users\Admin\vuoojew.exe"
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1984
                              • C:\Users\Admin\vauuq.exe
                                "C:\Users\Admin\vauuq.exe"
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2508
                                • C:\Users\Admin\svriq.exe
                                  "C:\Users\Admin\svriq.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:2812
                                  • C:\Users\Admin\buafoo.exe
                                    "C:\Users\Admin\buafoo.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2832
                                    • C:\Users\Admin\koejuuh.exe
                                      "C:\Users\Admin\koejuuh.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1744
                                      • C:\Users\Admin\laiiye.exe
                                        "C:\Users\Admin\laiiye.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1128
                                        • C:\Users\Admin\vuoojew.exe
                                          "C:\Users\Admin\vuoojew.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2020
                                          • C:\Users\Admin\quigeew.exe
                                            "C:\Users\Admin\quigeew.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2556
                                            • C:\Users\Admin\jiuuro.exe
                                              "C:\Users\Admin\jiuuro.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:880
                                              • C:\Users\Admin\roaqu.exe
                                                "C:\Users\Admin\roaqu.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2244
                                                • C:\Users\Admin\daooju.exe
                                                  "C:\Users\Admin\daooju.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:952
                                                  • C:\Users\Admin\tdwom.exe
                                                    "C:\Users\Admin\tdwom.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2464
                                                    • C:\Users\Admin\xbvoil.exe
                                                      "C:\Users\Admin\xbvoil.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2972
                                                      • C:\Users\Admin\nzqif.exe
                                                        "C:\Users\Admin\nzqif.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1540
                                                        • C:\Users\Admin\seoohit.exe
                                                          "C:\Users\Admin\seoohit.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:328
                                                          • C:\Users\Admin\gearii.exe
                                                            "C:\Users\Admin\gearii.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1612
                                                            • C:\Users\Admin\mauuje.exe
                                                              "C:\Users\Admin\mauuje.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2316
                                                              • C:\Users\Admin\maeezup.exe
                                                                "C:\Users\Admin\maeezup.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2672
                                                                • C:\Users\Admin\caoorif.exe
                                                                  "C:\Users\Admin\caoorif.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2944
                                                                  • C:\Users\Admin\nzqif.exe
                                                                    "C:\Users\Admin\nzqif.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2740
                                                                    • C:\Users\Admin\giawoo.exe
                                                                      "C:\Users\Admin\giawoo.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2308
                                                                      • C:\Users\Admin\daeevol.exe
                                                                        "C:\Users\Admin\daeevol.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3064
                                                                        • C:\Users\Admin\teasiy.exe
                                                                          "C:\Users\Admin\teasiy.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2480
                                                                          • C:\Users\Admin\muatoo.exe
                                                                            "C:\Users\Admin\muatoo.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2064
                                                                            • C:\Users\Admin\roemuup.exe
                                                                              "C:\Users\Admin\roemuup.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1044
                                                                              • C:\Users\Admin\boidu.exe
                                                                                "C:\Users\Admin\boidu.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2656
                                                                                • C:\Users\Admin\ceuur.exe
                                                                                  "C:\Users\Admin\ceuur.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1480
                                                                                  • C:\Users\Admin\meaxii.exe
                                                                                    "C:\Users\Admin\meaxii.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1980
                                                                                    • C:\Users\Admin\deuuno.exe
                                                                                      "C:\Users\Admin\deuuno.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1280
                                                                                      • C:\Users\Admin\wuebaan.exe
                                                                                        "C:\Users\Admin\wuebaan.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2212
                                                                                        • C:\Users\Admin\seoobit.exe
                                                                                          "C:\Users\Admin\seoobit.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2328
                                                                                          • C:\Users\Admin\hkyeoc.exe
                                                                                            "C:\Users\Admin\hkyeoc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2192
                                                                                            • C:\Users\Admin\dgxoim.exe
                                                                                              "C:\Users\Admin\dgxoim.exe"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2124
                                                                                              • C:\Users\Admin\mauuj.exe
                                                                                                "C:\Users\Admin\mauuj.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1612
                                                                                                • C:\Users\Admin\qolet.exe
                                                                                                  "C:\Users\Admin\qolet.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2692
                                                                                                  • C:\Users\Admin\diafuv.exe
                                                                                                    "C:\Users\Admin\diafuv.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2304
                                                                                                    • C:\Users\Admin\feodi.exe
                                                                                                      "C:\Users\Admin\feodi.exe"
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:2596
                                                                                                      • C:\Users\Admin\liejuuq.exe
                                                                                                        "C:\Users\Admin\liejuuq.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2740
                                                                                                        • C:\Users\Admin\poemuur.exe
                                                                                                          "C:\Users\Admin\poemuur.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:3020
                                                                                                          • C:\Users\Admin\geabot.exe
                                                                                                            "C:\Users\Admin\geabot.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2312
                                                                                                            • C:\Users\Admin\pauuj.exe
                                                                                                              "C:\Users\Admin\pauuj.exe"
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2072
                                                                                                              • C:\Users\Admin\pauuj.exe
                                                                                                                "C:\Users\Admin\pauuj.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2020
                                                                                                                • C:\Users\Admin\miaguu.exe
                                                                                                                  "C:\Users\Admin\miaguu.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1384
                                                                                                                  • C:\Users\Admin\jokif.exe
                                                                                                                    "C:\Users\Admin\jokif.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:2456
                                                                                                                    • C:\Users\Admin\zoemaah.exe
                                                                                                                      "C:\Users\Admin\zoemaah.exe"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:992
                                                                                                                      • C:\Users\Admin\kaosii.exe
                                                                                                                        "C:\Users\Admin\kaosii.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1848
                                                                                                                        • C:\Users\Admin\miaguu.exe
                                                                                                                          "C:\Users\Admin\miaguu.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:916
                                                                                                                          • C:\Users\Admin\qoiizur.exe
                                                                                                                            "C:\Users\Admin\qoiizur.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:1312
                                                                                                                            • C:\Users\Admin\peodi.exe
                                                                                                                              "C:\Users\Admin\peodi.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:2444
                                                                                                                              • C:\Users\Admin\wuqol.exe
                                                                                                                                "C:\Users\Admin\wuqol.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\lauuj.exe

    Filesize

    224KB

    MD5

    43f351c6e2004900a198c05d3518dde7

    SHA1

    7ec698932424a66e2abb329261b1888478194b8a

    SHA256

    c034d9ce9fe2736b3d6765ab0178e0103f5e84ae32a2aeebd604e54d175ac92b

    SHA512

    c16965e1798c8652068b699bf4807e6f74ed93714d6ca889cad575cf146203b86756a8e6e2ae43c589f81fbac9a6675076dae22e4a4502327b4a60d959859101

  • C:\Users\Admin\vuoojew.exe

    Filesize

    224KB

    MD5

    a3cecf50eb0ac6bab79bedb47c254eb1

    SHA1

    6316961a8017df1733a1317c01c643e9fdad562e

    SHA256

    ffe2e23a71a088b42fea05205bf7092808f41375581a2ad579837860605425a9

    SHA512

    c18034dc6696614ac22599ca8ced8caa3cb7620f82a86b2372409651a71a62d4621ac74c8ec058143e9bf2e71071d11dadd41453508e28bc8e4aa48db7fcd827

  • \Users\Admin\bauuye.exe

    Filesize

    224KB

    MD5

    90a5a71e0bfd5d51e2055b1053459837

    SHA1

    79574a325a87d109741db9ad1cf7f99c70aa6944

    SHA256

    605f421c01a2318ffab827c1c94a31f4ac79dffa6443c8cfc71093a9530b3e55

    SHA512

    11b2e9136649d743bd2755d55bb6402ecaf97b25cf4694531ed454bbab866b815074af0c72be33c449391673a90f7be95b16d3152e45954c23d6a78942b1d382

  • \Users\Admin\buafoo.exe

    Filesize

    224KB

    MD5

    1bd540634d8bc2960ebbe293733a2fa1

    SHA1

    c2bff6492c3c0163a27a70640ba2af49bede6fcd

    SHA256

    7806fbd7464866d37b81f9f025550939558c2ad1654ef081c7abe63a0f10b344

    SHA512

    ec5923e46b8a3e05512fd214dcf1ea98dd78a7ecc162ce25a2f11c035271213d40ae0c2fd5c4131193393f8e3eb8e6e711520fdb4ab21a4e53a61fa14c84d8dc

  • \Users\Admin\cgqod.exe

    Filesize

    224KB

    MD5

    1ff539d276ab238baa15624f9268c14b

    SHA1

    8b1375ebb655b29c2dfe9b6ab1700d34d57447f9

    SHA256

    690bdbe99ef02b98d644faf3a04649477f86640ea7043687276dd2a7a1cc19fe

    SHA512

    ed0127175be06705590ff0dae56812119caa3f9cac3b98b87950ec12db11ce4ad61a736c82f7e2e3bac95de143e51011bdbc558480cca8e127279e37a200d8c2

  • \Users\Admin\duaaxoq.exe

    Filesize

    224KB

    MD5

    c587c6cb2a4ba98aa5fa4b319880f4bd

    SHA1

    938dd9a2c3f63b5cef0bafb863f947a53269f32a

    SHA256

    edc45e13dabed1a6bdef18bd8c009c5692c074e96540c140e3095fe11343d4d7

    SHA512

    d8644425425b61dcd705b4ef0923689b1c2d64099f3afc6d322b0c9da34834ce0c76314dbfff939a7adea138680c4564e85e1279b5831124a800571ec436a2e1

  • \Users\Admin\feodi.exe

    Filesize

    224KB

    MD5

    217f249ce131884aaa07d4073932e998

    SHA1

    635b9db656c29f51026f669aa28f33e9a4dd5840

    SHA256

    b094f46bdb2f75834e42817616a60b8890aad27697dfb9dfc56d6fe005d92725

    SHA512

    a36b5c31ff5b2723c55f80e8fce77957765ac036fadc989ffda2dcea727329cac2eb2a74a3a9004e015e0e412ce4d4989bdd153896221ced7618ec7110453fcd

  • \Users\Admin\hokid.exe

    Filesize

    224KB

    MD5

    f17ca4614c1490cf85df063799c79846

    SHA1

    5a9b5ed6168fe518b3fd6bd52db6681796dbbf58

    SHA256

    c260d02baedd31c38a825d6f3a2af5dfe038fd743711b0dc9d1b82aa025c4223

    SHA512

    bf7f1121dfc3bd9a45e1930eb2c183f683886085ed9de88971b3a79608cf35d996ecc38e33ed358b4469042ce7d017ca67192fcc8f7ac62f3406e34db38a2238

  • \Users\Admin\jiafuy.exe

    Filesize

    224KB

    MD5

    d8412aab3f4e87b5c910a24d3efd63f2

    SHA1

    18742ff309e5f4625ce2df2d0a8d57aa6a56a94b

    SHA256

    274d7d460abbedbe35c33d04f9762561079f84bb9e97f05dd5c0038e7cbf8e96

    SHA512

    3d1242135ea812b6bbe20e49acf76dc85d5224d7cbe9a081c26d77c50aa2476cc3d0d53c7bde40f9b7ac4bbe8f7743d30338e09c9a05efd9cfaaf3576cd848c4

  • \Users\Admin\maoquv.exe

    Filesize

    224KB

    MD5

    f54e117ee2b9a36fab622f0dd246db3d

    SHA1

    f00d5dd6a78bec428e599de1545fd7c3ce902eee

    SHA256

    7143a1b8ade093f4d869ea3c9446992e1f4664edd04b607e28bdd1f5e517cea7

    SHA512

    57be80a25a7a5539fcbb06b41e76e776cb49cfb66dae50392520d91f47284ef2375669add9edd8f8d5c921900b344ae2b9183648607cb6a26079c8f784c7e263

  • \Users\Admin\moibu.exe

    Filesize

    224KB

    MD5

    3ea193a813358ad3aeaab3d85accbb48

    SHA1

    35cd55f4284f564c25be25c56a6c589c5d062639

    SHA256

    4ddae56cdc4555785b3f3de04548b6065e3fde4f8fa78766530d13db76a5485a

    SHA512

    f14218a6b0b40dc801ef7dbe2c2a485e9e1e2aaec49d538ee677e0c7d1d2de9c714b925cef486af4b169042fb5aebc91b716edf2dec99754bfbb545d360e202e

  • \Users\Admin\rauce.exe

    Filesize

    224KB

    MD5

    d0eb56a4f8c10c93eea254749b0e9fee

    SHA1

    c22cf3f64a0846e9a22d6955c33f8b233e7bc940

    SHA256

    fb02b7a4ba58544341850c46e6a6317a3b4f89b37a63507ebb64378226fb2c0d

    SHA512

    4b955d2dca7244d44f3bf037ccb9f3cb33a1fd0dcc498f1c12d5bfff7f2502a018a42590316db6ba14b2e33687d9dfffeec7f5c0cd20af3728e6d681cb05794f

  • \Users\Admin\saoinu.exe

    Filesize

    224KB

    MD5

    abbdba1cb3cd38762e798b5ac159cf1d

    SHA1

    3b546a3c049c045ce5a777f788e8755971dbf9c6

    SHA256

    9d54a984d85e2340e2abf3e0ce3b63677f858eb38ded216f2da4da6f8a5ef3d1

    SHA512

    255ce6a03bff33fbf59bd6b76dea85ae073726c2b500ff6d577035b45a45766d67413bb9144830eebaaa7c408de3847ddf2eee23b42a05c0ebe101d6306e7111

  • \Users\Admin\svriq.exe

    Filesize

    224KB

    MD5

    89aa7ee5a42d4ea0ea9cc4b20992e110

    SHA1

    e9c58ea938874273089c812091297ea426813b41

    SHA256

    d0ef118a5d03d82eb600532c405fe2a5b0a24d90419683332dcf089c79684386

    SHA512

    d0d0f786417038f6ef1b6429158adaec9bb1b9e6b6c8db54c4e4de845770479362260669417b1e790b78ceae3812d9b1f66e0567131ef86c66ce8f91dbb12604

  • \Users\Admin\vauuq.exe

    Filesize

    224KB

    MD5

    a690ebe7a6dfc8899bb63cd15907def9

    SHA1

    7e277c78d1461aaa302ad847c59941d643b6915c

    SHA256

    0772e85cfaa5c6a211a8fef2346835d2b5d735de7a62c6bbc4eef980864986a7

    SHA512

    95f6b32f17067c75601faffe5ad6e9e50f8f4993cd01be53d2a3e54c08e549c9babcba4b5c23b89f4580da9b298d51d22a1d617eeaf13fb2402d30eda4738b25

  • \Users\Admin\wuabe.exe

    Filesize

    224KB

    MD5

    717433564cfa0d1f0300e90bf7d94df5

    SHA1

    5df6e1702317cd5420e3831f5f782deca2b93e7e

    SHA256

    ca34cdad96bc45e1a63b15b1b9c923705bd84d7111c85178f4eba7b5c0f19811

    SHA512

    457c9ac824ee3a38295238a84abbe3544fc912e62699a9179012a7639d5ab900e8b31af0f52b56f142f51e863d67cf3f6535c921eb62829eb0ab41eb1e5cf8c6

  • memory/328-402-0x0000000003930000-0x000000000396A000-memory.dmp

    Filesize

    232KB

  • memory/328-393-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/328-408-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/880-320-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/880-332-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/880-334-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/952-359-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/952-347-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1128-295-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1128-291-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1304-181-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1304-165-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1540-394-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1540-381-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1612-419-0x0000000003760000-0x000000000379A000-memory.dmp

    Filesize

    232KB

  • memory/1612-406-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1612-420-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1744-281-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1744-294-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1744-290-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/1764-198-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1764-192-0x0000000003CA0000-0x0000000003CDA000-memory.dmp

    Filesize

    232KB

  • memory/1764-182-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1788-130-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1788-114-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1860-98-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1860-113-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1984-229-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1984-214-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2020-308-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2020-307-0x0000000003940000-0x000000000397A000-memory.dmp

    Filesize

    232KB

  • memory/2064-510-0x0000000002990000-0x00000000029CA000-memory.dmp

    Filesize

    232KB

  • memory/2064-502-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2244-333-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2244-345-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2308-474-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2308-475-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2308-462-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2308-477-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2316-434-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2316-428-0x0000000002790000-0x00000000027CA000-memory.dmp

    Filesize

    232KB

  • memory/2316-421-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2464-148-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2464-357-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2464-129-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2464-145-0x0000000003770000-0x00000000037AA000-memory.dmp

    Filesize

    232KB

  • memory/2464-369-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2464-146-0x0000000003770000-0x00000000037AA000-memory.dmp

    Filesize

    232KB

  • memory/2480-504-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2480-501-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2480-489-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2508-245-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2508-232-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2536-201-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-309-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-321-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-319-0x0000000003770000-0x00000000037AA000-memory.dmp

    Filesize

    232KB

  • memory/2572-164-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2572-166-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2572-157-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2572-147-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2576-97-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2576-81-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2672-445-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2672-441-0x0000000003760000-0x000000000379A000-memory.dmp

    Filesize

    232KB

  • memory/2672-435-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2740-463-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2740-461-0x00000000032A0000-0x00000000032DA000-memory.dmp

    Filesize

    232KB

  • memory/2740-460-0x00000000032A0000-0x00000000032DA000-memory.dmp

    Filesize

    232KB

  • memory/2812-263-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2812-261-0x0000000002E20000-0x0000000002E5A000-memory.dmp

    Filesize

    232KB

  • memory/2812-259-0x0000000002E20000-0x0000000002E5A000-memory.dmp

    Filesize

    232KB

  • memory/2812-248-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2832-266-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2832-278-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2832-277-0x0000000003670000-0x00000000036AA000-memory.dmp

    Filesize

    232KB

  • memory/2832-276-0x0000000003670000-0x00000000036AA000-memory.dmp

    Filesize

    232KB

  • memory/2844-49-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2844-47-0x00000000037E0000-0x000000000381A000-memory.dmp

    Filesize

    232KB

  • memory/2844-35-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2916-64-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2916-48-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2936-31-0x00000000038C0000-0x00000000038FA000-memory.dmp

    Filesize

    232KB

  • memory/2936-15-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2936-30-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2944-448-0x00000000038B0000-0x00000000038EA000-memory.dmp

    Filesize

    232KB

  • memory/2944-449-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2972-383-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2972-370-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3024-82-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3024-65-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3024-79-0x0000000003870000-0x00000000038AA000-memory.dmp

    Filesize

    232KB

  • memory/3048-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3048-14-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3064-488-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3064-476-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB