Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1000b9b6cf27...f7.exe
windows7-x64
300b9b6cf27...f7.exe
windows10-2004-x64
305500734fe...81.exe
windows7-x64
05500734fe...81.exe
windows10-2004-x64
0b75e2fadf...c5.exe
windows7-x64
80b75e2fadf...c5.exe
windows10-2004-x64
80d5fa75218...64.exe
windows7-x64
100d5fa75218...64.exe
windows10-2004-x64
101760c5727e...9c.exe
windows7-x64
101760c5727e...9c.exe
windows10-2004-x64
101fe99fb7c5...81.exe
windows7-x64
101fe99fb7c5...81.exe
windows10-2004-x64
102336173567...98.exe
windows7-x64
102336173567...98.exe
windows10-2004-x64
102522b83852...03.exe
windows7-x64
102522b83852...03.exe
windows10-2004-x64
102af6bc16f2...b2.exe
windows7-x64
102af6bc16f2...b2.exe
windows10-2004-x64
103d9f9c162e...64.exe
windows7-x64
73d9f9c162e...64.exe
windows10-2004-x64
73db846a796...e5.exe
windows7-x64
103db846a796...e5.exe
windows10-2004-x64
10493813116f...dc.exe
windows7-x64
10493813116f...dc.exe
windows10-2004-x64
104d61a61265...08.exe
windows7-x64
104d61a61265...08.exe
windows10-2004-x64
10510827ce68...c5.exe
windows7-x64
10510827ce68...c5.exe
windows10-2004-x64
105642f8bd3b...2a.exe
windows7-x64
105642f8bd3b...2a.exe
windows10-2004-x64
106c37d14d5a...4c.exe
windows7-x64
106c37d14d5a...4c.exe
windows10-2004-x64
10Resubmissions
21/08/2024, 19:30
240821-x76q3sweqg 1021/08/2024, 17:42
240821-v92h2avgpj 1012/06/2024, 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 19:30
Behavioral task
behavioral1
Sample
00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
05500734fe07ac2b5bc89aa12b090203c4b74851cb0d62bd388f27ec6d6caa81.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
05500734fe07ac2b5bc89aa12b090203c4b74851cb0d62bd388f27ec6d6caa81.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2522b83852588bc0f7f620f9b4fe3a9337b9608be335d3958d190275f333df03.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
2522b83852588bc0f7f620f9b4fe3a9337b9608be335d3958d190275f333df03.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
493813116f32ad6f455676cd54e32a2167ece845038202614cbb49e126f5afdc.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral24
Sample
493813116f32ad6f455676cd54e32a2167ece845038202614cbb49e126f5afdc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral26
Sample
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
-
Size
9.4MB
-
MD5
813b749967045532f86e6442447bcd8b
-
SHA1
8d0615e7f7ba672a3fc94c05a9451f9d08797af7
-
SHA256
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
-
SHA512
47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
-
SSDEEP
24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral7/memory/2668-8-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral7/memory/2668-10-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral7/memory/2668-12-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral7/memory/2668-15-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral7/memory/2668-17-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral7/memory/2668-16-0x0000000000400000-0x0000000000538000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 1688 dwm.exe 444 dwm.exe -
Loads dropped DLL 6 IoCs
pid Process 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1688 dwm.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2280 set thread context of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 1688 set thread context of 444 1688 dwm.exe 59 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2764 2280 WerFault.exe 30 2884 1688 WerFault.exe 49 -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 6 IoCs
pid Process 2956 timeout.exe 804 timeout.exe 2660 timeout.exe 2736 timeout.exe 1324 timeout.exe 2748 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe 3056 schtasks.exe 1188 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1688 dwm.exe 1688 dwm.exe 1688 dwm.exe 444 dwm.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 1688 dwm.exe Token: SeDebugPrivilege 444 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2060 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2280 wrote to memory of 2060 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2280 wrote to memory of 2060 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2280 wrote to memory of 2060 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2060 wrote to memory of 2956 2060 cmd.exe 33 PID 2060 wrote to memory of 2956 2060 cmd.exe 33 PID 2060 wrote to memory of 2956 2060 cmd.exe 33 PID 2060 wrote to memory of 2956 2060 cmd.exe 33 PID 2280 wrote to memory of 2988 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2280 wrote to memory of 2988 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2280 wrote to memory of 2988 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2280 wrote to memory of 2988 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2988 wrote to memory of 804 2988 cmd.exe 36 PID 2988 wrote to memory of 804 2988 cmd.exe 36 PID 2988 wrote to memory of 804 2988 cmd.exe 36 PID 2988 wrote to memory of 804 2988 cmd.exe 36 PID 2280 wrote to memory of 2160 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2280 wrote to memory of 2160 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2280 wrote to memory of 2160 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2280 wrote to memory of 2160 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2160 wrote to memory of 2660 2160 cmd.exe 39 PID 2160 wrote to memory of 2660 2160 cmd.exe 39 PID 2160 wrote to memory of 2660 2160 cmd.exe 39 PID 2160 wrote to memory of 2660 2160 cmd.exe 39 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2668 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2280 wrote to memory of 2764 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 41 PID 2280 wrote to memory of 2764 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 41 PID 2280 wrote to memory of 2764 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 41 PID 2280 wrote to memory of 2764 2280 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 41 PID 2668 wrote to memory of 2584 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 43 PID 2668 wrote to memory of 2584 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 43 PID 2668 wrote to memory of 2584 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 43 PID 2668 wrote to memory of 2584 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 43 PID 2668 wrote to memory of 3056 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 45 PID 2668 wrote to memory of 3056 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 45 PID 2668 wrote to memory of 3056 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 45 PID 2668 wrote to memory of 3056 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 45 PID 2668 wrote to memory of 1188 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 47 PID 2668 wrote to memory of 1188 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 47 PID 2668 wrote to memory of 1188 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 47 PID 2668 wrote to memory of 1188 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 47 PID 2668 wrote to memory of 1688 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 49 PID 2668 wrote to memory of 1688 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 49 PID 2668 wrote to memory of 1688 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 49 PID 2668 wrote to memory of 1688 2668 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 49 PID 1688 wrote to memory of 1864 1688 dwm.exe 50 PID 1688 wrote to memory of 1864 1688 dwm.exe 50 PID 1688 wrote to memory of 1864 1688 dwm.exe 50 PID 1688 wrote to memory of 1864 1688 dwm.exe 50 PID 1864 wrote to memory of 2736 1864 cmd.exe 52 PID 1864 wrote to memory of 2736 1864 cmd.exe 52 PID 1864 wrote to memory of 2736 1864 cmd.exe 52 PID 1864 wrote to memory of 2736 1864 cmd.exe 52 PID 1688 wrote to memory of 1448 1688 dwm.exe 53 PID 1688 wrote to memory of 1448 1688 dwm.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2956
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:804
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2584
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\smss.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3056
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Application Data\dwm.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1188
-
-
C:\Users\Default\Application Data\dwm.exe"C:\Users\Default\Application Data\dwm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2736
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1324
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
-
C:\Users\Default\Application Data\dwm.exe"C:\Users\Default\Application Data\dwm.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 5364⤵
- Loads dropped DLL
- Program crash
PID:2884
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 8722⤵
- Program crash
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
MD5813b749967045532f86e6442447bcd8b
SHA18d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA2560d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
SHA51247c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877