Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
Resource
win7-20240704-en
General
-
Target
39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
-
Size
1.0MB
-
MD5
56cb4177698cacbaf3f194fbc133f3d5
-
SHA1
6b52cec6871d408f7e71584eea5ea08b103130ad
-
SHA256
39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8
-
SHA512
c47813abaa38f4fd758e6d277311a3fcdac317cacee7a852461a10b2e2f90697f9eddfa325a257acc1d086b401770794f38af93ebd7327b006d46e647a171a4a
-
SSDEEP
12288:Mmhjxw7dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxL5BwcyQVaE:Lhe7alj3DSudvGM3MXTVhtSQWGtxkPQF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation viqdhzdkrg.exe -
Executes dropped EXE 4 IoCs
pid Process 2344 viqdhzdkrg.exe 2544 gyznnbxlsj.exe 3152 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 3328 bindsvc.exe -
resource yara_rule behavioral2/files/0x0002000000022b23-13.dat upx behavioral2/memory/2544-15-0x0000000000320000-0x000000000049A000-memory.dmp upx behavioral2/memory/2544-232-0x0000000000320000-0x000000000049A000-memory.dmp upx behavioral2/memory/2544-241-0x0000000000320000-0x000000000049A000-memory.dmp upx -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\System32\bindsvc.exe gyznnbxlsj.exe File created C:\Windows\SysWOW64\wideshut.exe gyznnbxlsj.exe File opened for modification C:\Windows\SysWOW64\wideshut.exe gyznnbxlsj.exe File created C:\Windows\SysWOW64\wimsvc.exe gyznnbxlsj.exe File created C:\Windows\SysWOW64\racfg.exe gyznnbxlsj.exe File created C:\Windows\SysWOW64\bindsvc.exe gyznnbxlsj.exe File created C:\Windows\system32\msfte.dll gyznnbxlsj.exe File created C:\Windows\system32\oci.dll gyznnbxlsj.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4384 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bindsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language viqdhzdkrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gyznnbxlsj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdb52ddeb3fcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd661fdeb3fcda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdb52ddeb3fcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002da21adeb3fcda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000041911deb3fcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001dc34deb3fcda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2544 gyznnbxlsj.exe 2544 gyznnbxlsj.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: 33 2256 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2256 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4028 wrote to memory of 2344 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 86 PID 4028 wrote to memory of 2344 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 86 PID 4028 wrote to memory of 2344 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 86 PID 4028 wrote to memory of 2544 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 87 PID 4028 wrote to memory of 2544 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 87 PID 4028 wrote to memory of 2544 4028 39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe 87 PID 2256 wrote to memory of 2476 2256 SearchIndexer.exe 90 PID 2256 wrote to memory of 2476 2256 SearchIndexer.exe 90 PID 2256 wrote to memory of 3676 2256 SearchIndexer.exe 91 PID 2256 wrote to memory of 3676 2256 SearchIndexer.exe 91 PID 2344 wrote to memory of 3152 2344 viqdhzdkrg.exe 92 PID 2344 wrote to memory of 3152 2344 viqdhzdkrg.exe 92 PID 2344 wrote to memory of 3152 2344 viqdhzdkrg.exe 92 PID 2544 wrote to memory of 4728 2544 gyznnbxlsj.exe 100 PID 2544 wrote to memory of 4728 2544 gyznnbxlsj.exe 100 PID 4728 wrote to memory of 4384 4728 cmd.exe 102 PID 4728 wrote to memory of 4384 4728 cmd.exe 102 PID 2544 wrote to memory of 816 2544 gyznnbxlsj.exe 103 PID 2544 wrote to memory of 816 2544 gyznnbxlsj.exe 103 PID 2544 wrote to memory of 3328 2544 gyznnbxlsj.exe 104 PID 2544 wrote to memory of 3328 2544 gyznnbxlsj.exe 104 PID 2544 wrote to memory of 3328 2544 gyznnbxlsj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe"C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe" "C:\Users\Admin\AppData\Local\Temp\exmbkuavuc.exe" "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exeC:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\System32\cmd.exe/c sc config msdtc obj= LocalSystem3⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\sc.exesc config msdtc obj= LocalSystem4⤵
- Launches sc.exe
PID:4384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Q7xm88zW.bat"3⤵PID:816
-
-
C:\Windows\System32\bindsvc.exe"C:\Windows\System32\bindsvc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328
-
-
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2476
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196B
MD5762236efa938f5bba17503da5850b196
SHA1f943415a336eac937a4f3665af471a6cd04ecc90
SHA256d3afa5e8e603756b8a3f4e75d8a877feac001aeef1db2461ee2bcbeae72f76be
SHA51225000d74a89cc652a4158aa6da91476aaeff3746f79f7d56f07ba2a634d31aab8c609dff2447b3248450b01ef4afc6c55bda4935141dae8dba967e1ac787b329
-
Filesize
209KB
MD58d98511924d571c2b0e11d765b857a8a
SHA1b9ce4bacd3e7e644626fae63f746d4466dba737e
SHA256666902c802f71eafbbb130664af70cea1d0cae2798b5be979b29ae9fc43feb7e
SHA512925d53bb92ae82b83456d5728e58f608576ba633ce08ef440b4bd4fb04f4db5cf6a171548ff37feca3dc3f89838b9852d4ed74e05f4e07179751f3630ca9ad04
-
Filesize
580KB
MD52c2029588ad8b86759c17b7ae885ee03
SHA191653b5344d4c210201218e2f215dd5228d76799
SHA2563ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
SHA51288531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
-
Filesize
51KB
MD5e48b89715bf5e4c55eb5a1fed67865d9
SHA189a287da39e14b02cdc284eb287549462346d724
SHA256c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
SHA5124bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
-
Filesize
291KB
MD57c5b397fb54d5aa06bd2a6fb99c62fee
SHA1a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA256d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
SHA512daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c