Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 01:08
Behavioral task
behavioral1
Sample
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe
-
Size
40KB
-
MD5
4a683b19df48d3d0648687e2d5a9aa4b
-
SHA1
d801e10fe987f448dcaef191f5f3bfe08bdbe158
-
SHA256
9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d
-
SHA512
f90b1264924c3efab1836c417b0478d9ffca9cb81123c61ca7bdac7d16dc63e6ec121474f79f84a0261271f5b46409fb3688f7e791ecc392ac34ff215ada08a7
-
SSDEEP
768:TeSXrX8ltlmge8gzRB0Tv04VZcwFqCqDfQJ:TfrezZg92TvZmzf+
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3576 lanmanwrk.exe 4636 lanmanwrk.exe 2416 lanmanwrk.exe 3568 lanmanwrk.exe 1548 lanmanwrk.exe 2260 lanmanwrk.exe 1480 lanmanwrk.exe 2460 lanmanwrk.exe 1200 lanmanwrk.exe 4252 lanmanwrk.exe 4856 lanmanwrk.exe 4592 lanmanwrk.exe 5044 lanmanwrk.exe 3228 lanmanwrk.exe 3504 lanmanwrk.exe 564 lanmanwrk.exe 3168 lanmanwrk.exe 1496 lanmanwrk.exe 1624 lanmanwrk.exe 4476 lanmanwrk.exe 5036 lanmanwrk.exe 3480 lanmanwrk.exe 1064 lanmanwrk.exe 4524 lanmanwrk.exe 1564 lanmanwrk.exe 4424 lanmanwrk.exe 3192 lanmanwrk.exe 2220 lanmanwrk.exe 2304 lanmanwrk.exe 1236 lanmanwrk.exe 3144 lanmanwrk.exe 2156 lanmanwrk.exe 1568 lanmanwrk.exe 1216 lanmanwrk.exe 4012 lanmanwrk.exe 1072 lanmanwrk.exe 4328 lanmanwrk.exe 4412 lanmanwrk.exe 2620 lanmanwrk.exe 1736 lanmanwrk.exe 756 lanmanwrk.exe 3468 lanmanwrk.exe 3332 lanmanwrk.exe 3508 lanmanwrk.exe 3312 lanmanwrk.exe 1512 lanmanwrk.exe 464 lanmanwrk.exe 1488 lanmanwrk.exe 228 lanmanwrk.exe 4984 lanmanwrk.exe 1092 lanmanwrk.exe 5080 lanmanwrk.exe 388 lanmanwrk.exe 4068 lanmanwrk.exe 1536 lanmanwrk.exe 1400 lanmanwrk.exe 4436 lanmanwrk.exe 3248 lanmanwrk.exe 2500 lanmanwrk.exe 1996 lanmanwrk.exe 3968 lanmanwrk.exe 4488 lanmanwrk.exe 3748 lanmanwrk.exe 3928 lanmanwrk.exe -
resource yara_rule behavioral2/memory/3076-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3076-5-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/files/0x000800000002346e-4.dat upx behavioral2/memory/3576-10-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4636-14-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2416-18-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3568-22-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1548-26-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2260-30-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1480-34-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2460-38-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1200-42-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4252-46-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4856-50-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4592-53-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/5044-58-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3228-62-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3504-66-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/564-70-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3168-74-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1496-78-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4476-85-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/5036-88-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3480-93-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1064-97-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4524-101-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1564-105-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4424-108-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3192-112-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2220-117-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2304-121-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1236-124-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3144-128-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2156-131-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1568-133-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1216-135-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4012-137-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1072-139-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4328-141-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4412-143-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2620-145-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1736-147-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3468-150-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3332-152-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3508-154-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3312-156-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1512-158-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/464-160-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1488-162-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/228-164-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4984-166-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/5080-169-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/388-171-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4068-173-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1536-175-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1400-177-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3248-180-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/2500-182-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3968-185-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4488-187-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3748-189-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3928-191-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1760-193-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1508-195-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll lanmanwrk.exe File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found File created C:\Windows\SysWOW64\lanmanwrk.exe Process not Found File opened for modification C:\Windows\SysWOW64\iexchg.dll Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lanmanwrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3576 3076 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 87 PID 3076 wrote to memory of 3576 3076 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 87 PID 3076 wrote to memory of 3576 3076 9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe 87 PID 3576 wrote to memory of 4636 3576 lanmanwrk.exe 88 PID 3576 wrote to memory of 4636 3576 lanmanwrk.exe 88 PID 3576 wrote to memory of 4636 3576 lanmanwrk.exe 88 PID 4636 wrote to memory of 2416 4636 lanmanwrk.exe 89 PID 4636 wrote to memory of 2416 4636 lanmanwrk.exe 89 PID 4636 wrote to memory of 2416 4636 lanmanwrk.exe 89 PID 2416 wrote to memory of 3568 2416 lanmanwrk.exe 90 PID 2416 wrote to memory of 3568 2416 lanmanwrk.exe 90 PID 2416 wrote to memory of 3568 2416 lanmanwrk.exe 90 PID 3568 wrote to memory of 1548 3568 lanmanwrk.exe 91 PID 3568 wrote to memory of 1548 3568 lanmanwrk.exe 91 PID 3568 wrote to memory of 1548 3568 lanmanwrk.exe 91 PID 1548 wrote to memory of 2260 1548 lanmanwrk.exe 92 PID 1548 wrote to memory of 2260 1548 lanmanwrk.exe 92 PID 1548 wrote to memory of 2260 1548 lanmanwrk.exe 92 PID 2260 wrote to memory of 1480 2260 lanmanwrk.exe 93 PID 2260 wrote to memory of 1480 2260 lanmanwrk.exe 93 PID 2260 wrote to memory of 1480 2260 lanmanwrk.exe 93 PID 1480 wrote to memory of 2460 1480 lanmanwrk.exe 94 PID 1480 wrote to memory of 2460 1480 lanmanwrk.exe 94 PID 1480 wrote to memory of 2460 1480 lanmanwrk.exe 94 PID 2460 wrote to memory of 1200 2460 lanmanwrk.exe 95 PID 2460 wrote to memory of 1200 2460 lanmanwrk.exe 95 PID 2460 wrote to memory of 1200 2460 lanmanwrk.exe 95 PID 1200 wrote to memory of 4252 1200 lanmanwrk.exe 96 PID 1200 wrote to memory of 4252 1200 lanmanwrk.exe 96 PID 1200 wrote to memory of 4252 1200 lanmanwrk.exe 96 PID 4252 wrote to memory of 4856 4252 lanmanwrk.exe 97 PID 4252 wrote to memory of 4856 4252 lanmanwrk.exe 97 PID 4252 wrote to memory of 4856 4252 lanmanwrk.exe 97 PID 4856 wrote to memory of 4592 4856 lanmanwrk.exe 98 PID 4856 wrote to memory of 4592 4856 lanmanwrk.exe 98 PID 4856 wrote to memory of 4592 4856 lanmanwrk.exe 98 PID 4592 wrote to memory of 5044 4592 lanmanwrk.exe 99 PID 4592 wrote to memory of 5044 4592 lanmanwrk.exe 99 PID 4592 wrote to memory of 5044 4592 lanmanwrk.exe 99 PID 5044 wrote to memory of 3228 5044 lanmanwrk.exe 100 PID 5044 wrote to memory of 3228 5044 lanmanwrk.exe 100 PID 5044 wrote to memory of 3228 5044 lanmanwrk.exe 100 PID 3228 wrote to memory of 3504 3228 lanmanwrk.exe 101 PID 3228 wrote to memory of 3504 3228 lanmanwrk.exe 101 PID 3228 wrote to memory of 3504 3228 lanmanwrk.exe 101 PID 3504 wrote to memory of 564 3504 lanmanwrk.exe 102 PID 3504 wrote to memory of 564 3504 lanmanwrk.exe 102 PID 3504 wrote to memory of 564 3504 lanmanwrk.exe 102 PID 564 wrote to memory of 3168 564 lanmanwrk.exe 103 PID 564 wrote to memory of 3168 564 lanmanwrk.exe 103 PID 564 wrote to memory of 3168 564 lanmanwrk.exe 103 PID 3168 wrote to memory of 1496 3168 lanmanwrk.exe 104 PID 3168 wrote to memory of 1496 3168 lanmanwrk.exe 104 PID 3168 wrote to memory of 1496 3168 lanmanwrk.exe 104 PID 1496 wrote to memory of 1624 1496 lanmanwrk.exe 105 PID 1496 wrote to memory of 1624 1496 lanmanwrk.exe 105 PID 1496 wrote to memory of 1624 1496 lanmanwrk.exe 105 PID 1624 wrote to memory of 4476 1624 lanmanwrk.exe 106 PID 1624 wrote to memory of 4476 1624 lanmanwrk.exe 106 PID 1624 wrote to memory of 4476 1624 lanmanwrk.exe 106 PID 4476 wrote to memory of 5036 4476 lanmanwrk.exe 107 PID 4476 wrote to memory of 5036 4476 lanmanwrk.exe 107 PID 4476 wrote to memory of 5036 4476 lanmanwrk.exe 107 PID 5036 wrote to memory of 3480 5036 lanmanwrk.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe"C:\Users\Admin\AppData\Local\Temp\9dd1cb0c54598b8b22879c4a919690c5517d95a31e411af08392e5443d48334d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe23⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe24⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe25⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe26⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe27⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe28⤵
- Executes dropped EXE
PID:3192 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe29⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe30⤵
- Executes dropped EXE
PID:2304 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe31⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe32⤵
- Executes dropped EXE
PID:3144 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe33⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe34⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe35⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe37⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe38⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe39⤵
- Executes dropped EXE
PID:4412 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe40⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe41⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe42⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe43⤵
- Executes dropped EXE
PID:3468 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe44⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe45⤵
- Executes dropped EXE
PID:3508 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe46⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe47⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe48⤵
- Executes dropped EXE
PID:464 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe49⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe50⤵
- Executes dropped EXE
PID:228 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe51⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe52⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe53⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe54⤵
- Executes dropped EXE
PID:388 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe55⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe56⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe57⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe58⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe59⤵
- Executes dropped EXE
PID:3248 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe60⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe61⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe62⤵
- Executes dropped EXE
PID:3968 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe63⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe64⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe65⤵
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe66⤵PID:1760
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe67⤵PID:1508
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe68⤵PID:1028
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe69⤵PID:5088
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe70⤵PID:3132
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe71⤵PID:2872
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe72⤵PID:4420
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe73⤵PID:4484
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe74⤵PID:4592
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe75⤵PID:5044
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe76⤵PID:4352
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe77⤵PID:3920
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe78⤵PID:4940
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe79⤵PID:4304
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe80⤵PID:3412
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe81⤵PID:820
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe82⤵PID:1296
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe83⤵PID:1624
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe84⤵PID:3260
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe85⤵PID:4084
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe86⤵PID:2936
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe87⤵PID:1784
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe88⤵PID:2952
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe89⤵PID:3452
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe90⤵PID:4460
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe91⤵PID:4456
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe92⤵PID:2792
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe93⤵PID:4708
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe94⤵PID:2220
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe95⤵PID:5092
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe96⤵PID:4700
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe97⤵PID:3068
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe98⤵PID:1260
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe99⤵PID:2156
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe100⤵PID:1848
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe101⤵PID:3124
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe102⤵PID:2216
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe103⤵PID:3856
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe104⤵PID:3492
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe105⤵PID:4080
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe106⤵PID:1120
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe107⤵PID:452
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe108⤵PID:3140
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe109⤵PID:1976
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe110⤵PID:3540
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe111⤵PID:928
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe112⤵PID:1392
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe113⤵PID:764
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe114⤵PID:1512
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe115⤵
- Drops file in System32 directory
PID:464 -
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe116⤵PID:2556
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe117⤵PID:4816
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe118⤵PID:4872
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe119⤵PID:5080
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe120⤵PID:5012
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe121⤵PID:2504
-
C:\Windows\SysWOW64\lanmanwrk.exeC:\Windows\System32\lanmanwrk.exe122⤵
- Drops file in System32 directory
PID:4316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-