Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
597s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
build.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
build.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
build.exe
Resource
win11-20240802-en
General
-
Target
build.exe
-
Size
7.1MB
-
MD5
03b4a7f20fdad6d69d148a3426b499af
-
SHA1
29c2f0d4a32776ba00c8dd882d35fdbfaec343ad
-
SHA256
54ec62ac33637ed3bf49e914bfb9e5245e12fbebfb91e44705cd08b29e05b59c
-
SHA512
a2ba94f54a34a6e40d312ad63d71dec427ee3a80f300e97381f9541a6ac3fb67bc7095df38e045d088c893e92cc24058a93e02d9087c963cfbf1f6baf02c0b78
-
SSDEEP
196608:B/4iA3qoIyI47/Q3D+h6Pkvct9GcemuYX:B/3AaZDQ/Q3D+hEkUacxX
Malware Config
Signatures
-
Modifies security service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100 svchost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2364 powershell.exe 2388 powershell.exe -
Creates new service(s) 2 TTPs
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ZPGRVBPA\ImagePath = "C:\\ProgramData\\gauhbkggpybj\\yrzhndhoiexf.exe" services.exe -
Executes dropped EXE 1 IoCs
pid Process 2476 yrzhndhoiexf.exe -
Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 472 services.exe 472 services.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VS57P4WV\desktop.ini DllHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\542OWCDO\desktop.ini DllHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini DllHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I17U52WV\desktop.ini DllHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2MIHKBD\desktop.ini DllHost.exe -
Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe yrzhndhoiexf.exe File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File opened for modification C:\Windows\system32\MRT.exe build.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 292 set thread context of 1972 292 build.exe 46 PID 2476 set thread context of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 set thread context of 264 2476 yrzhndhoiexf.exe 72 PID 2476 set thread context of 1236 2476 yrzhndhoiexf.exe 73 -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2800 sc.exe 2468 sc.exe 2980 sc.exe 2856 sc.exe 2312 sc.exe 2892 sc.exe 2348 sc.exe 2840 sc.exe 2900 sc.exe 2728 sc.exe 2440 sc.exe 2956 sc.exe 3012 sc.exe 2352 sc.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0bb0792d1f2da01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 292 build.exe 2364 powershell.exe 292 build.exe 292 build.exe 292 build.exe 292 build.exe 292 build.exe 292 build.exe 292 build.exe 292 build.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 292 build.exe 1972 dialer.exe 1972 dialer.exe 292 build.exe 292 build.exe 1972 dialer.exe 1972 dialer.exe 2476 yrzhndhoiexf.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 2388 powershell.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 1972 dialer.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 1972 dialer.exe 1972 dialer.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 2476 yrzhndhoiexf.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 2476 yrzhndhoiexf.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe 1240 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2364 powershell.exe Token: SeDebugPrivilege 292 build.exe Token: SeDebugPrivilege 1972 dialer.exe Token: SeAuditPrivilege 852 svchost.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeDebugPrivilege 2476 yrzhndhoiexf.exe Token: SeDebugPrivilege 1240 dialer.exe Token: SeLockMemoryPrivilege 1236 dialer.exe Token: SeAssignPrimaryTokenPrivilege 852 svchost.exe Token: SeIncreaseQuotaPrivilege 852 svchost.exe Token: SeSecurityPrivilege 852 svchost.exe Token: SeTakeOwnershipPrivilege 852 svchost.exe Token: SeLoadDriverPrivilege 852 svchost.exe Token: SeSystemtimePrivilege 852 svchost.exe Token: SeBackupPrivilege 852 svchost.exe Token: SeRestorePrivilege 852 svchost.exe Token: SeShutdownPrivilege 852 svchost.exe Token: SeSystemEnvironmentPrivilege 852 svchost.exe Token: SeUndockPrivilege 852 svchost.exe Token: SeManageVolumePrivilege 852 svchost.exe Token: SeAssignPrimaryTokenPrivilege 852 svchost.exe Token: SeIncreaseQuotaPrivilege 852 svchost.exe Token: SeSecurityPrivilege 852 svchost.exe Token: SeTakeOwnershipPrivilege 852 svchost.exe Token: SeLoadDriverPrivilege 852 svchost.exe Token: SeSystemtimePrivilege 852 svchost.exe Token: SeBackupPrivilege 852 svchost.exe Token: SeRestorePrivilege 852 svchost.exe Token: SeShutdownPrivilege 852 svchost.exe Token: SeSystemEnvironmentPrivilege 852 svchost.exe Token: SeUndockPrivilege 852 svchost.exe Token: SeManageVolumePrivilege 852 svchost.exe Token: SeAssignPrimaryTokenPrivilege 852 svchost.exe Token: SeIncreaseQuotaPrivilege 852 svchost.exe Token: SeSecurityPrivilege 852 svchost.exe Token: SeTakeOwnershipPrivilege 852 svchost.exe Token: SeLoadDriverPrivilege 852 svchost.exe Token: SeSystemtimePrivilege 852 svchost.exe Token: SeBackupPrivilege 852 svchost.exe Token: SeRestorePrivilege 852 svchost.exe Token: SeShutdownPrivilege 852 svchost.exe Token: SeSystemEnvironmentPrivilege 852 svchost.exe Token: SeUndockPrivilege 852 svchost.exe Token: SeManageVolumePrivilege 852 svchost.exe Token: SeAssignPrimaryTokenPrivilege 852 svchost.exe Token: SeIncreaseQuotaPrivilege 852 svchost.exe Token: SeSecurityPrivilege 852 svchost.exe Token: SeTakeOwnershipPrivilege 852 svchost.exe Token: SeLoadDriverPrivilege 852 svchost.exe Token: SeSystemtimePrivilege 852 svchost.exe Token: SeBackupPrivilege 852 svchost.exe Token: SeRestorePrivilege 852 svchost.exe Token: SeShutdownPrivilege 852 svchost.exe Token: SeSystemEnvironmentPrivilege 852 svchost.exe Token: SeUndockPrivilege 852 svchost.exe Token: SeManageVolumePrivilege 852 svchost.exe Token: SeAssignPrimaryTokenPrivilege 852 svchost.exe Token: SeIncreaseQuotaPrivilege 852 svchost.exe Token: SeSecurityPrivilege 852 svchost.exe Token: SeTakeOwnershipPrivilege 852 svchost.exe Token: SeLoadDriverPrivilege 852 svchost.exe Token: SeSystemtimePrivilege 852 svchost.exe Token: SeBackupPrivilege 852 svchost.exe Token: SeRestorePrivilege 852 svchost.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 852 svchost.exe 1652 wmiprvse.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2708 2912 cmd.exe 37 PID 2912 wrote to memory of 2708 2912 cmd.exe 37 PID 2912 wrote to memory of 2708 2912 cmd.exe 37 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 292 wrote to memory of 1972 292 build.exe 46 PID 1972 wrote to memory of 428 1972 dialer.exe 5 PID 1972 wrote to memory of 472 1972 dialer.exe 6 PID 1972 wrote to memory of 488 1972 dialer.exe 7 PID 1972 wrote to memory of 496 1972 dialer.exe 8 PID 1972 wrote to memory of 588 1972 dialer.exe 9 PID 1972 wrote to memory of 668 1972 dialer.exe 10 PID 1972 wrote to memory of 732 1972 dialer.exe 11 PID 1972 wrote to memory of 808 1972 dialer.exe 12 PID 1972 wrote to memory of 852 1972 dialer.exe 13 PID 1972 wrote to memory of 972 1972 dialer.exe 15 PID 1972 wrote to memory of 280 1972 dialer.exe 16 PID 1972 wrote to memory of 340 1972 dialer.exe 17 PID 1972 wrote to memory of 1068 1972 dialer.exe 18 PID 1972 wrote to memory of 1104 1972 dialer.exe 19 PID 1972 wrote to memory of 1160 1972 dialer.exe 20 PID 1972 wrote to memory of 1200 1972 dialer.exe 21 PID 1972 wrote to memory of 2044 1972 dialer.exe 23 PID 1972 wrote to memory of 1292 1972 dialer.exe 24 PID 1972 wrote to memory of 1652 1972 dialer.exe 25 PID 1972 wrote to memory of 3008 1972 dialer.exe 26 PID 1972 wrote to memory of 2280 1972 dialer.exe 27 PID 1972 wrote to memory of 292 1972 dialer.exe 29 PID 1972 wrote to memory of 1728 1972 dialer.exe 32 PID 1972 wrote to memory of 2956 1972 dialer.exe 47 PID 1972 wrote to memory of 2716 1972 dialer.exe 48 PID 1972 wrote to memory of 2312 1972 dialer.exe 49 PID 1972 wrote to memory of 2188 1972 dialer.exe 50 PID 1972 wrote to memory of 2440 1972 dialer.exe 52 PID 1972 wrote to memory of 1504 1972 dialer.exe 53 PID 1972 wrote to memory of 2476 1972 dialer.exe 55 PID 472 wrote to memory of 2476 472 services.exe 55 PID 472 wrote to memory of 2476 472 services.exe 55 PID 472 wrote to memory of 2476 472 services.exe 55 PID 1972 wrote to memory of 2476 1972 dialer.exe 55 PID 1972 wrote to memory of 2388 1972 dialer.exe 56 PID 1972 wrote to memory of 2400 1972 dialer.exe 57 PID 2988 wrote to memory of 1364 2988 cmd.exe 64 PID 2988 wrote to memory of 1364 2988 cmd.exe 64 PID 2988 wrote to memory of 1364 2988 cmd.exe 64 PID 1972 wrote to memory of 2988 1972 dialer.exe 58 PID 1972 wrote to memory of 2332 1972 dialer.exe 61 PID 1972 wrote to memory of 2892 1972 dialer.exe 62 PID 1972 wrote to memory of 2884 1972 dialer.exe 63 PID 1972 wrote to memory of 1364 1972 dialer.exe 64 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 1240 2476 yrzhndhoiexf.exe 71 PID 2476 wrote to memory of 264 2476 yrzhndhoiexf.exe 72 PID 2476 wrote to memory of 264 2476 yrzhndhoiexf.exe 72 PID 2476 wrote to memory of 264 2476 yrzhndhoiexf.exe 72
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵
- Drops desktop.ini file(s)
PID:2044
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵
- Suspicious use of UnmapMainImage
PID:1652
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding3⤵
- Checks processor information in registry
PID:1752
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
- Indicator Removal: Clear Windows Event Logs
PID:732
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1160
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:852 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1728
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1068
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"2⤵PID:1292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:3008
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:2280
-
-
C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exeC:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
- Drops file in Windows directory
PID:1364
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:2728
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:2348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:2800
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:2352
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵PID:264
-
-
C:\Windows\system32\dialer.exedialer.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:488
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:496
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
- Drops file in Windows directory
PID:2708
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:2468
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:2840
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:2900
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:2980
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:2856
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ZPGRVBPA"3⤵
- Launches sc.exe
PID:2956
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ZPGRVBPA" binpath= "C:\ProgramData\gauhbkggpybj\yrzhndhoiexf.exe" start= "auto"3⤵
- Launches sc.exe
PID:2312
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:3012
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ZPGRVBPA"3⤵
- Launches sc.exe
PID:2440
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-127828148224269495-500525298-580997658-1251886297-2145191506-12034633281296141190"1⤵PID:2716
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-5675656893500742611425313334-316721571584643115-105328542921201913241051762910"1⤵PID:2188
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "129898677-1361648553-1886611770691702932-326743444-14394986931445263678920601704"1⤵PID:1504
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-624657954-9756788743506911123179747541380602282726215503-15004733471054617099"1⤵PID:2400
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-20943304939661022282050347448-1686775165-20706312561770796336-1360074530851818678"1⤵PID:2332
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1759976581-88807785256640763713042828331491732487-3065341282122345499-1094713024"1⤵PID:2884
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
Filesize
150KB
MD5540138285295c68de32a419b7d9de687
SHA11cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56
SHA25633867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb
SHA5127c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a
-
Filesize
141KB
MD5831dbe568992299e589143ee8898e131
SHA1737726173aab8b76fe1f98104d72bb91abd273bf
SHA2564f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405
SHA51239015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139
-
Filesize
142KB
MD53d6173f88cedd8ce2e8b6f8a950da9f4
SHA1b71f069292013cdce86366d99d41189fd692eb15
SHA256c346e3d57328d97c7d66512c6f26ce0ad1cf907cd876eed1a9bc684484a5920e
SHA512e6681267db289789220587e4bc1ce54bad0a4235281f7c62d3b20a5f7c297ebf491b5be89ab02438c5c90399871ce3b1c3f8acb4f14f13380984ab3665ce118f
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
Filesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
Filesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
Filesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
Filesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
Filesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
Filesize
7.1MB
MD503b4a7f20fdad6d69d148a3426b499af
SHA129c2f0d4a32776ba00c8dd882d35fdbfaec343ad
SHA25654ec62ac33637ed3bf49e914bfb9e5245e12fbebfb91e44705cd08b29e05b59c
SHA512a2ba94f54a34a6e40d312ad63d71dec427ee3a80f300e97381f9541a6ac3fb67bc7095df38e045d088c893e92cc24058a93e02d9087c963cfbf1f6baf02c0b78