Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
BTC.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
BTC.exe
Resource
win10v2004-20240802-en
General
-
Target
BTC.exe
-
Size
1.1MB
-
MD5
f1424e5b9810a4a9c33506aa784fca89
-
SHA1
4ad6287fe149832551afbcb1113db50cd133777b
-
SHA256
8a3da2a07e82bf22f3cd239de861b2b8c50c9fe9ee2ba12a33564e1b5cc93fed
-
SHA512
e03432137a7c12c03d34302fe4e1774a3a08935d39f665e4086fd8637f4ea961a645e2a8bb3cd85dd24c54861e4f01b0500a70641e2fa3a4a09e2e89a3b77380
-
SSDEEP
12288:JYYjzzONcuuIYsYNeaCbU6sKySaVQ4pBgncu7EKHCBbsCU/hpgmxCBbsCUXEGnF9:eg9uurUngnBU97EniCUppoiCUXfF9
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
185.252.232.158:7812
64.23.232.116:7812
vsvf
-
delay
1
-
install
true
-
install_file
Windows Security Health Service.exe
-
install_folder
%AppData%
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7479631857:AAFuIUMNJYKHzJ3Bc9t4FSh9ZQXlqymhFnk/sendMessage?chat_id=6291749148
https://api.telegram.org/bot7074211690:AAFHdtGIEk1j3FpHjh6_p8Xjh9rfZDo4uSc/sendMessage?chat_id=6291749148
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
quasar
2.1.0.0
Office04
146.190.29.250:7812
VNM_MUTEX_h1gQxrpyccCFZq7JPS
-
encryption_key
V5fWyT4tQqXFouaUUxe2
-
install_name
Windows Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir34
Extracted
xworm
5.0
146.190.29.250:7812
165.227.91.90:7812
167.99.94.206:7812
4chIqEbR5Rq6U6EI
-
Install_directory
%AppData%
-
install_file
Windows Defender Service Host.exe
-
telegram
https://api.telegram.org/bot7074211690:AAFHdtGIEk1j3FpHjh6_p8Xjh9rfZDo4uSc/sendMessage?chat_id=6291749148
Signatures
-
Contains code to disable Windows Defender 4 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00310000000185e6-31.dat disable_win_def behavioral1/memory/2948-36-0x00000000003D0000-0x000000000045C000-memory.dmp disable_win_def behavioral1/memory/1088-51-0x0000000000910000-0x000000000099C000-memory.dmp disable_win_def behavioral1/memory/2496-291-0x0000000001290000-0x000000000131C000-memory.dmp disable_win_def -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000018b3e-40.dat family_xworm behavioral1/memory/840-42-0x0000000000F20000-0x0000000000F32000-memory.dmp family_xworm -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Window Security.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Window Security.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Window Security.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Window Security.exe -
Quasar payload 4 IoCs
resource yara_rule behavioral1/files/0x00310000000185e6-31.dat family_quasar behavioral1/memory/2948-36-0x00000000003D0000-0x000000000045C000-memory.dmp family_quasar behavioral1/memory/1088-51-0x0000000000910000-0x000000000099C000-memory.dmp family_quasar behavioral1/memory/2496-291-0x0000000001290000-0x000000000131C000-memory.dmp family_quasar -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/files/0x00070000000186c2-18.dat family_stormkitty behavioral1/files/0x0007000000018b03-24.dat family_stormkitty behavioral1/memory/2748-33-0x0000000001110000-0x0000000001140000-memory.dmp family_stormkitty behavioral1/memory/2336-34-0x0000000000950000-0x000000000098E000-memory.dmp family_stormkitty -
Async RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0004000000017801-13.dat family_asyncrat behavioral1/files/0x00070000000186c2-18.dat family_asyncrat behavioral1/files/0x0007000000018b03-24.dat family_asyncrat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes itself 1 IoCs
pid Process 640 cmd.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Service Host.lnk Windows Defender Service Host.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Service Host.lnk Windows Defender Service Host.exe -
Executes dropped EXE 9 IoCs
pid Process 2332 crack.exe 2852 Cracked.exe 2748 svchost.exe 2336 update.exe 2948 Window Security.exe 840 Windows Defender Service Host.exe 1088 Windows Security.exe 288 Windows Security Health Service.exe 2496 Window Security.exe -
Loads dropped DLL 1 IoCs
pid Process 2948 Window Security.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Window Security.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Window Security.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Service Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender Service Host.exe" Windows Defender Service Host.exe -
Drops desktop.ini file(s) 11 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\f3e21bc56224c42cd37cb427a30c91ac\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini update.exe File opened for modification C:\Users\Admin\AppData\Local\f3e21bc56224c42cd37cb427a30c91ac\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini update.exe File created C:\Users\Admin\AppData\Local\f3e21bc56224c42cd37cb427a30c91ac\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini update.exe File opened for modification C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Local\f3e21bc56224c42cd37cb427a30c91ac\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini update.exe File created C:\Users\Admin\AppData\Local\f3e21bc56224c42cd37cb427a30c91ac\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini update.exe File created C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini svchost.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 22 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Window Security.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Window Security.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows Security.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2536 PING.EXE -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2376 cmd.exe 1108 netsh.exe 1244 cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 update.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier update.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2132 timeout.exe 1324 timeout.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2536 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2276 schtasks.exe 2908 schtasks.exe 2004 schtasks.exe 2372 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 840 Windows Defender Service Host.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 2852 Cracked.exe 840 Windows Defender Service Host.exe 2632 powershell.exe 2748 svchost.exe 2336 update.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 2748 svchost.exe 2336 update.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 2748 svchost.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe 288 Windows Security Health Service.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 840 Windows Defender Service Host.exe Token: SeDebugPrivilege 2852 Cracked.exe Token: SeDebugPrivilege 2336 update.exe Token: SeDebugPrivilege 2748 svchost.exe Token: SeDebugPrivilege 2332 crack.exe Token: SeDebugPrivilege 2948 Window Security.exe Token: SeDebugPrivilege 2852 Cracked.exe Token: SeDebugPrivilege 1088 Windows Security.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 1088 Windows Security.exe Token: SeDebugPrivilege 288 Windows Security Health Service.exe Token: SeDebugPrivilege 288 Windows Security Health Service.exe Token: SeDebugPrivilege 2496 Window Security.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 840 Windows Defender Service Host.exe 1088 Windows Security.exe 288 Windows Security Health Service.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2332 2928 BTC.exe 29 PID 2928 wrote to memory of 2332 2928 BTC.exe 29 PID 2928 wrote to memory of 2332 2928 BTC.exe 29 PID 2928 wrote to memory of 2332 2928 BTC.exe 29 PID 2928 wrote to memory of 2852 2928 BTC.exe 30 PID 2928 wrote to memory of 2852 2928 BTC.exe 30 PID 2928 wrote to memory of 2852 2928 BTC.exe 30 PID 2928 wrote to memory of 2748 2928 BTC.exe 31 PID 2928 wrote to memory of 2748 2928 BTC.exe 31 PID 2928 wrote to memory of 2748 2928 BTC.exe 31 PID 2928 wrote to memory of 2748 2928 BTC.exe 31 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2336 2928 BTC.exe 32 PID 2928 wrote to memory of 2948 2928 BTC.exe 33 PID 2928 wrote to memory of 2948 2928 BTC.exe 33 PID 2928 wrote to memory of 2948 2928 BTC.exe 33 PID 2928 wrote to memory of 2948 2928 BTC.exe 33 PID 2928 wrote to memory of 840 2928 BTC.exe 34 PID 2928 wrote to memory of 840 2928 BTC.exe 34 PID 2928 wrote to memory of 840 2928 BTC.exe 34 PID 2948 wrote to memory of 2276 2948 Window Security.exe 36 PID 2948 wrote to memory of 2276 2948 Window Security.exe 36 PID 2948 wrote to memory of 2276 2948 Window Security.exe 36 PID 2948 wrote to memory of 2276 2948 Window Security.exe 36 PID 2948 wrote to memory of 1088 2948 Window Security.exe 38 PID 2948 wrote to memory of 1088 2948 Window Security.exe 38 PID 2948 wrote to memory of 1088 2948 Window Security.exe 38 PID 2948 wrote to memory of 1088 2948 Window Security.exe 38 PID 2948 wrote to memory of 2632 2948 Window Security.exe 39 PID 2948 wrote to memory of 2632 2948 Window Security.exe 39 PID 2948 wrote to memory of 2632 2948 Window Security.exe 39 PID 2948 wrote to memory of 2632 2948 Window Security.exe 39 PID 840 wrote to memory of 2908 840 Windows Defender Service Host.exe 41 PID 840 wrote to memory of 2908 840 Windows Defender Service Host.exe 41 PID 840 wrote to memory of 2908 840 Windows Defender Service Host.exe 41 PID 2852 wrote to memory of 1348 2852 Cracked.exe 43 PID 2852 wrote to memory of 1348 2852 Cracked.exe 43 PID 2852 wrote to memory of 1348 2852 Cracked.exe 43 PID 2852 wrote to memory of 1100 2852 Cracked.exe 44 PID 2852 wrote to memory of 1100 2852 Cracked.exe 44 PID 2852 wrote to memory of 1100 2852 Cracked.exe 44 PID 1348 wrote to memory of 2004 1348 cmd.exe 47 PID 1348 wrote to memory of 2004 1348 cmd.exe 47 PID 1348 wrote to memory of 2004 1348 cmd.exe 47 PID 1100 wrote to memory of 2132 1100 cmd.exe 48 PID 1100 wrote to memory of 2132 1100 cmd.exe 48 PID 1100 wrote to memory of 2132 1100 cmd.exe 48 PID 2332 wrote to memory of 2440 2332 crack.exe 49 PID 2332 wrote to memory of 2440 2332 crack.exe 49 PID 2332 wrote to memory of 2440 2332 crack.exe 49 PID 2332 wrote to memory of 2440 2332 crack.exe 49 PID 2440 wrote to memory of 1324 2440 cmd.exe 51 PID 2440 wrote to memory of 1324 2440 cmd.exe 51 PID 2440 wrote to memory of 1324 2440 cmd.exe 51 PID 2440 wrote to memory of 1324 2440 cmd.exe 51 PID 1088 wrote to memory of 2372 1088 Windows Security.exe 52 PID 1088 wrote to memory of 2372 1088 Windows Security.exe 52 PID 1088 wrote to memory of 2372 1088 Windows Security.exe 52 PID 1088 wrote to memory of 2372 1088 Windows Security.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BTC.exe"C:\Users\Admin\AppData\Local\Temp\BTC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\crack.exe"C:\Users\Admin\AppData\Roaming\crack.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD1B.tmp.cmd""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1324
-
-
-
-
C:\Users\Admin\AppData\Roaming\Cracked.exe"C:\Users\Admin\AppData\Roaming\Cracked.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"'4⤵
- Scheduled Task/Job: Scheduled Task
PID:2004
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp925.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:2132
-
-
C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:288
-
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1244 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1108
-
-
-
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2376 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:2356
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1520
-
-
-
-
C:\Users\Admin\AppData\Roaming\Window Security.exe"C:\Users\Admin\AppData\Roaming\Window Security.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Window Security.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2276
-
-
C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe"C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2372
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- System Location Discovery: System Language Discovery
PID:656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OeVJTdovhonS.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2536
-
-
C:\Users\Admin\AppData\Roaming\Window Security.exe"C:\Users\Admin\AppData\Roaming\Window Security.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
-
-
C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender Service Host" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2908
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {6A224D94-B890-4C88-9D73-0F559D05117D} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]1⤵PID:2952
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\675a695163d7b51d531f554aa2370cb7\Admin@MVFYZPLM_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
209B
MD502c01722adf936dd5b7212980f033d02
SHA1477d2751b01383b2f9fefa550b955e9460781bf1
SHA256d378692e059869c185a2b76d5a57e2a1eecf0eb6d4bda9b8fd6a018ae06b6d28
SHA512ed5aaa6cf412f218c153b0988608191ac598015527b6762a52d29f2d2caa767357317df67ec134fd10c926f44a31400b0421b6486a6c744f692ed6f6124bad2e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
5.0MB
MD502f11ac7b19e4903ae52e46082bd4503
SHA11c599437d0918d2c1ce298839e201a5473054d28
SHA256eedab2d55fe86bb0566c022f913e0f39b4507cfa7cc7b53e9c8a44cad057f7f3
SHA51208520f1f86c4dfb951008c5c8f7103f80335e61c94302a2b5f39a403b0189df8f1997571f3a3a2777f5dd845d17ccc84f2a0f96956fed8a14c58d8f0c24c4662
-
Filesize
92KB
MD5dd6944619a1cff7c63c0e49ed65368ca
SHA1a055ce9efa2206cdc35b924d43a5d06f453ce777
SHA25658ea6de2879649260c0a62b6e8e045e88c3311978e993f63a8dfcdb0dba9f05d
SHA512856d454cd202fc39bec08f7ea7fb9c631e5531c1d5ffc269d3ea4ef2cdd568b176da0f8e00ffd8c80eaad461cecbce213fa4cd46b142a7760fd32815261fddd7
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
174B
MD5c09b9a5213c16a54fd3a0f1991d3b319
SHA1755076fded30feacea49bb06173f0047e11e4924
SHA256a47900b7d51625cea64d7165ead3285760f14069c2534977898a96b057ae4b81
SHA512f8245533734a5d64f7d2b2b023c6f24f667df717c5e36ee82635c8df291714e8398648ff358550114ca329affa161f44342c345705c516a6b191a023fdd86bb7
-
Filesize
150B
MD5b71d08af159200d4218ee90b5b126aba
SHA1c64446b0ece410e1f480f3ed4337a5f8ed38e610
SHA256a51c249c6d3488a9ccbc0f59f5e8b6d102481c90f3b000f2253a0552e1282644
SHA5124fadbd47feaf3617fa101418e50e20268c6b491893f62d0af0cec5ef006e62340e56c00efa33a40a7609c22c0defc7e3c10579980d62c825b0e64aae56fa7418
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
Filesize
74KB
MD50dfa83a82f6418c73406d78296de61be
SHA1dd7eceef8a434c43e0751e180bf714e08771d336
SHA2568d27369ffa8b29d561fa9daf485be14d2fc00287bb1c69d4c84d514891c8db5e
SHA5129a4b026250b18c29ab7dd48203f321c2ef2f12695bd2dcb52ebbc15001c8ddf019d5a7e04da056c50c1881ce269d1810259bf6d04b61f471e8751b7192fc73d4
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
534KB
MD581b2c5c64951b603480d40d321540ff2
SHA1314199ad92baeb203f5555ff3814e9b7a4f226f8
SHA256b893220d33f9b8a0f98702bb577e4459792253ae651bdc18a93145ccd008af54
SHA5123a57655bf7aa18a34364659553aad26a3d5b8946b957441f5fedebab5936b6bb2c71c6337837ead486a001b6a9227437cc5c4ec4a5de627f0e2db10dc6afdea6
-
Filesize
43KB
MD55322a12cb24e83bfa9746fbde06d07e7
SHA15263a4f26bda073e9f82dd4fa612eb494dd771c7
SHA2564957d607c2984f94a258dba088fa1ab85e508bfaabe9279bf8b6bf6f4b97a9bb
SHA51267bfaef1ddf4ad44218c82c5634e7f726304845fab1d5361353fdacd8d8d767fec32c871fa304f4199dde3f6224be76c67560a64c1d72bbe20e134c50d1bf058
-
Filesize
8KB
MD59215015740c937980b6b53cee5087769
SHA1a0bfe95486944f1548620d4de472c3758e95d36a
SHA256a5390a297f14ef8f5be308009ec436d2a58598188dbb92d7299795a10ba1c541
SHA5125b9bbf1836466d803d3e160a38e10c8397aa3966c120ab6435a52b7d0a09eb664ef2172bf0e7e2de1cc3eae261167c9355fa7ac3b1b7e4504a7e07b82c4b90e2
-
Filesize
170KB
MD596014694a042d8344b910bc47d79337b
SHA19d19ab2f110ae58f30965a5a3d608cbf51986edb
SHA2564950eb74909bd6e739e38e57d8c6465c76ef108d65cac9f130d3f5c6d2fe943f
SHA512fe308c42b3ad2c3d73a834399aa12ea23f336103389181dface80a81da8be1ffd9a950cac802dc8a806ad318eb90a6bb6021d1acd9206a07749f83f2bb6cd03d
-
Filesize
225KB
MD5b8df7316cc35a0fb6fe3a326b4283010
SHA1d49c11f5a95f72e37d6194df41178f2b7faa01ee
SHA256f243df692ee7552286d52b23e4993e07a27877aa86c63b84903a8e6cbd0d19f3
SHA5123ef92be29123695820970a003fd0561a57f87c8c6adae86781729027ce40ede4b63da30d0b0cc75376bd9ae90accaf674fc7ff799a8b73ab4bb45b2ca65ff120