Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3bdcd08123d...18.exe
windows7-x64
7bdcd08123d...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/gtapi.dll
windows7-x64
3$SYSDIR/gtapi.dll
windows10-2004-x64
3$TEMP/Goog...ed.msi
windows7-x64
6$TEMP/Goog...ed.msi
windows10-2004-x64
6UUPlayer.dll
windows7-x64
3UUPlayer.dll
windows10-2004-x64
3UUSeePlayer.exe
windows7-x64
10UUSeePlayer.exe
windows10-2004-x64
10bass-plugins.exe
windows7-x64
7bass-plugins.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3CoCode.dll
windows7-x64
3CoCode.dll
windows10-2004-x64
3UFDeMux.dll
windows7-x64
3UFDeMux.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
bdcd08123d21c1c5c7a1a3cd95096437_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
bdcd08123d21c1c5c7a1a3cd95096437_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$SYSDIR/gtapi.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
$SYSDIR/gtapi.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
UUPlayer.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
UUPlayer.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
UUSeePlayer.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
UUSeePlayer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
bass-plugins.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
bass-plugins.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
CoCode.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral30
Sample
CoCode.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
UFDeMux.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral32
Sample
UFDeMux.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
-
Size
1.1MB
-
MD5
ec1629e2086cad6ccc4c995630896213
-
SHA1
e0e1f7720072b85c04318d6d15b595d7e8f52670
-
SHA256
101fc387cb284a27c943ea087b751aefb5c106a214253b7e29e7381da95beaee
-
SHA512
3f7157a25a2d1f1fc345e9138ed5c1f17805256be985e8cfe54c60cb5a11d62e13472bdeee187c7b13e5746c8d9e08359d929410d3b5e5ab204cf4f91c02d9b1
-
SSDEEP
24576:FBkI5/nyOeMDyWd8Dce5HrY5w6Rsa31L5Dh66NIXiQcAqHVIYzgD:jhyOeMPacWHruwOsa31L5Dh66N+iVh1O
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1708 msiexec.exe 5 2596 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\f77405a.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f77405a.msi msiexec.exe File created C:\Windows\Installer\f77405b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4646.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4676.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Executes dropped EXE 1 IoCs
pid Process 2904 MSI4676.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1708 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI4676.tmp -
Modifies data under HKEY_USERS 51 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" MSI4676.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MSI4676.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MSI4676.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main MSI4676.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" MSI4676.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings MSI4676.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MSI4676.tmp Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MSI4676.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2596 msiexec.exe 2596 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 1708 msiexec.exe Token: SeIncreaseQuotaPrivilege 1708 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeSecurityPrivilege 2596 msiexec.exe Token: SeCreateTokenPrivilege 1708 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1708 msiexec.exe Token: SeLockMemoryPrivilege 1708 msiexec.exe Token: SeIncreaseQuotaPrivilege 1708 msiexec.exe Token: SeMachineAccountPrivilege 1708 msiexec.exe Token: SeTcbPrivilege 1708 msiexec.exe Token: SeSecurityPrivilege 1708 msiexec.exe Token: SeTakeOwnershipPrivilege 1708 msiexec.exe Token: SeLoadDriverPrivilege 1708 msiexec.exe Token: SeSystemProfilePrivilege 1708 msiexec.exe Token: SeSystemtimePrivilege 1708 msiexec.exe Token: SeProfSingleProcessPrivilege 1708 msiexec.exe Token: SeIncBasePriorityPrivilege 1708 msiexec.exe Token: SeCreatePagefilePrivilege 1708 msiexec.exe Token: SeCreatePermanentPrivilege 1708 msiexec.exe Token: SeBackupPrivilege 1708 msiexec.exe Token: SeRestorePrivilege 1708 msiexec.exe Token: SeShutdownPrivilege 1708 msiexec.exe Token: SeDebugPrivilege 1708 msiexec.exe Token: SeAuditPrivilege 1708 msiexec.exe Token: SeSystemEnvironmentPrivilege 1708 msiexec.exe Token: SeChangeNotifyPrivilege 1708 msiexec.exe Token: SeRemoteShutdownPrivilege 1708 msiexec.exe Token: SeUndockPrivilege 1708 msiexec.exe Token: SeSyncAgentPrivilege 1708 msiexec.exe Token: SeEnableDelegationPrivilege 1708 msiexec.exe Token: SeManageVolumePrivilege 1708 msiexec.exe Token: SeImpersonatePrivilege 1708 msiexec.exe Token: SeCreateGlobalPrivilege 1708 msiexec.exe Token: SeBackupPrivilege 2024 vssvc.exe Token: SeRestorePrivilege 2024 vssvc.exe Token: SeAuditPrivilege 2024 vssvc.exe Token: SeBackupPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 MSI4676.tmp 2904 MSI4676.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 PID 2596 wrote to memory of 2904 2596 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_zh-CN_signed.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1708
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\Installer\MSI4676.tmp"C:\Windows\Installer\MSI4676.tmp" /m /sid:S-1-5-21-2172136094-3310281978-782691160-10002⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003BC" "00000000000003A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_ED584AAC2FBD1CBE20B4485E3FEDDA73
Filesize416B
MD5b982644eeb28405c0eb7a3c255dc7bb3
SHA1f4d77a5589eb03a3bed2e4e424b9e1851964ae96
SHA256741b6d92349a89ef9e5db0707f82da509a79df10e0959f799a5b467b9f4da69e
SHA512b7403b948e9e903661714e245f800e865b8c01eb74f4447b149f135bc22b2f4a90c681ed754872f0b8a3f554e3b9198e8825d3ae9e95019717e4b124dc9c3e98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deac9203570053a7f318ec6d5117c15c
SHA1453520061689a0903860a6b38f98113735572fe5
SHA256fa8a389fdfef4d1e9c92714649378c3bb47cbad1ecf54d571ff457248d85ce55
SHA512a0e2cba519b4ea5f5818f8e50b41bafc7f149c836a752f87a62f8fa3cedaacbe44d80dab47a0e107d0b59f13628af319b0de8379e4239c010f0319679943a1ea
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
975KB
MD54e98bab8bd44b65009308965d7a290bd
SHA1fd18b75202981c5d5746ff784f603918f7fe7308
SHA2565ef44aa6c9d1dfd031a1f8c1d0d9e83f08b3e05658b67c3f9504f9c88f2e76ca
SHA512b363c0ba6b0cf702347de7fb002bd3c1af3315e53d69e005e94703c00c8e5b66e34b5c89ab3f11048a3c8c6fd622e3d9617ef91e9c621936acb43c6c48569c6d