Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
0376e2dbd776b4b1a74ecebd73ccb580N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0376e2dbd776b4b1a74ecebd73ccb580N.exe
Resource
win10v2004-20240802-en
General
-
Target
0376e2dbd776b4b1a74ecebd73ccb580N.exe
-
Size
88KB
-
MD5
0376e2dbd776b4b1a74ecebd73ccb580
-
SHA1
404632978194a31e64804b5c62fe8acff7c91760
-
SHA256
6119d58486d1317da2c96f5d611a2253487b97c55ac01d2fed4458354a31f307
-
SHA512
d7cc39c6f8cbe6cbe2e6e43bee77027adc17fff26c4edfe47f7aadd439233a127779dbd49189ab04aed01408e8c2522a1a622c49d7530fb7e2f2dad99cb99b7e
-
SSDEEP
768:5vw9816thKQLro94/wQkNrfrunMxVFA3V:lEG/0o9lbunMxVS3V
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB}\stubpath = "C:\\Windows\\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe" 0376e2dbd776b4b1a74ecebd73ccb580N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{932C1E59-4BCF-4529-BFA4-139736ABAEDA}\stubpath = "C:\\Windows\\{932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe" {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87788BA8-0C99-41ed-8503-8C41BFE95AFE} {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82191743-AAEC-4517-9B13-52AFE947829E} {889743A8-76AA-4046-9913-2A4972E15198}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89515D02-0AA7-419e-B3B0-CBF8544B49C2}\stubpath = "C:\\Windows\\{89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe" {82191743-AAEC-4517-9B13-52AFE947829E}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0833BD2-3C19-48c4-893D-F8BF24457A69} {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}\stubpath = "C:\\Windows\\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe" {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBA5001-3BB6-4966-A003-C957521F3C73}\stubpath = "C:\\Windows\\{DBBA5001-3BB6-4966-A003-C957521F3C73}.exe" {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB} 0376e2dbd776b4b1a74ecebd73ccb580N.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{932C1E59-4BCF-4529-BFA4-139736ABAEDA} {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBA5001-3BB6-4966-A003-C957521F3C73} {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{889743A8-76AA-4046-9913-2A4972E15198}\stubpath = "C:\\Windows\\{889743A8-76AA-4046-9913-2A4972E15198}.exe" {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B} {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87788BA8-0C99-41ed-8503-8C41BFE95AFE}\stubpath = "C:\\Windows\\{87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe" {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{889743A8-76AA-4046-9913-2A4972E15198} {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82191743-AAEC-4517-9B13-52AFE947829E}\stubpath = "C:\\Windows\\{82191743-AAEC-4517-9B13-52AFE947829E}.exe" {889743A8-76AA-4046-9913-2A4972E15198}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89515D02-0AA7-419e-B3B0-CBF8544B49C2} {82191743-AAEC-4517-9B13-52AFE947829E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0833BD2-3C19-48c4-893D-F8BF24457A69}\stubpath = "C:\\Windows\\{D0833BD2-3C19-48c4-893D-F8BF24457A69}.exe" {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe -
Executes dropped EXE 9 IoCs
pid Process 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 2484 {D0833BD2-3C19-48c4-893D-F8BF24457A69}.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe File created C:\Windows\{82191743-AAEC-4517-9B13-52AFE947829E}.exe {889743A8-76AA-4046-9913-2A4972E15198}.exe File created C:\Windows\{89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe {82191743-AAEC-4517-9B13-52AFE947829E}.exe File created C:\Windows\{D0833BD2-3C19-48c4-893D-F8BF24457A69}.exe {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe File created C:\Windows\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 0376e2dbd776b4b1a74ecebd73ccb580N.exe File created C:\Windows\{932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe File created C:\Windows\{87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe File created C:\Windows\{DBBA5001-3BB6-4966-A003-C957521F3C73}.exe {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe File created C:\Windows\{889743A8-76AA-4046-9913-2A4972E15198}.exe {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {889743A8-76AA-4046-9913-2A4972E15198}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0376e2dbd776b4b1a74ecebd73ccb580N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D0833BD2-3C19-48c4-893D-F8BF24457A69}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {82191743-AAEC-4517-9B13-52AFE947829E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe Token: SeIncBasePriorityPrivilege 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe Token: SeIncBasePriorityPrivilege 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe Token: SeIncBasePriorityPrivilege 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe Token: SeIncBasePriorityPrivilege 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe Token: SeIncBasePriorityPrivilege 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe Token: SeIncBasePriorityPrivilege 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe Token: SeIncBasePriorityPrivilege 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe Token: SeIncBasePriorityPrivilege 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 4600 wrote to memory of 5988 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 102 PID 4600 wrote to memory of 5988 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 102 PID 4600 wrote to memory of 5988 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 102 PID 4600 wrote to memory of 3156 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 103 PID 4600 wrote to memory of 3156 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 103 PID 4600 wrote to memory of 3156 4600 0376e2dbd776b4b1a74ecebd73ccb580N.exe 103 PID 5988 wrote to memory of 4924 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 104 PID 5988 wrote to memory of 4924 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 104 PID 5988 wrote to memory of 4924 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 104 PID 5988 wrote to memory of 4480 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 105 PID 5988 wrote to memory of 4480 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 105 PID 5988 wrote to memory of 4480 5988 {2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe 105 PID 4924 wrote to memory of 1804 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 108 PID 4924 wrote to memory of 1804 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 108 PID 4924 wrote to memory of 1804 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 108 PID 4924 wrote to memory of 676 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 109 PID 4924 wrote to memory of 676 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 109 PID 4924 wrote to memory of 676 4924 {932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe 109 PID 1804 wrote to memory of 4876 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 110 PID 1804 wrote to memory of 4876 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 110 PID 1804 wrote to memory of 4876 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 110 PID 1804 wrote to memory of 3972 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 111 PID 1804 wrote to memory of 3972 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 111 PID 1804 wrote to memory of 3972 1804 {6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe 111 PID 4876 wrote to memory of 3168 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 112 PID 4876 wrote to memory of 3168 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 112 PID 4876 wrote to memory of 3168 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 112 PID 4876 wrote to memory of 5724 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 113 PID 4876 wrote to memory of 5724 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 113 PID 4876 wrote to memory of 5724 4876 {87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe 113 PID 3168 wrote to memory of 1052 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 114 PID 3168 wrote to memory of 1052 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 114 PID 3168 wrote to memory of 1052 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 114 PID 3168 wrote to memory of 3408 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 115 PID 3168 wrote to memory of 3408 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 115 PID 3168 wrote to memory of 3408 3168 {DBBA5001-3BB6-4966-A003-C957521F3C73}.exe 115 PID 1052 wrote to memory of 4360 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 116 PID 1052 wrote to memory of 4360 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 116 PID 1052 wrote to memory of 4360 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 116 PID 1052 wrote to memory of 5628 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 117 PID 1052 wrote to memory of 5628 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 117 PID 1052 wrote to memory of 5628 1052 {889743A8-76AA-4046-9913-2A4972E15198}.exe 117 PID 4360 wrote to memory of 4676 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 118 PID 4360 wrote to memory of 4676 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 118 PID 4360 wrote to memory of 4676 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 118 PID 4360 wrote to memory of 440 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 119 PID 4360 wrote to memory of 440 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 119 PID 4360 wrote to memory of 440 4360 {82191743-AAEC-4517-9B13-52AFE947829E}.exe 119 PID 4676 wrote to memory of 2484 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 120 PID 4676 wrote to memory of 2484 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 120 PID 4676 wrote to memory of 2484 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 120 PID 4676 wrote to memory of 4572 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 121 PID 4676 wrote to memory of 4572 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 121 PID 4676 wrote to memory of 4572 4676 {89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\0376e2dbd776b4b1a74ecebd73ccb580N.exe"C:\Users\Admin\AppData\Local\Temp\0376e2dbd776b4b1a74ecebd73ccb580N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exeC:\Windows\{2A78DA9E-85D3-4d3f-B801-394D68A05ABB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\{932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exeC:\Windows\{932C1E59-4BCF-4529-BFA4-139736ABAEDA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exeC:\Windows\{6822D83F-2ACC-4ee4-B2A8-D3EC1040E33B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\{87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exeC:\Windows\{87788BA8-0C99-41ed-8503-8C41BFE95AFE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\{DBBA5001-3BB6-4966-A003-C957521F3C73}.exeC:\Windows\{DBBA5001-3BB6-4966-A003-C957521F3C73}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\{889743A8-76AA-4046-9913-2A4972E15198}.exeC:\Windows\{889743A8-76AA-4046-9913-2A4972E15198}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\{82191743-AAEC-4517-9B13-52AFE947829E}.exeC:\Windows\{82191743-AAEC-4517-9B13-52AFE947829E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\{89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exeC:\Windows\{89515D02-0AA7-419e-B3B0-CBF8544B49C2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\{D0833BD2-3C19-48c4-893D-F8BF24457A69}.exeC:\Windows\{D0833BD2-3C19-48c4-893D-F8BF24457A69}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89515~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:4572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82191~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88974~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:5628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBBA5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87788~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:5724
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6822D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{932C1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:676
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A78D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:4480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\0376E2~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4768,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:81⤵PID:4528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5158cc509ea7e3d2fdce5d97ed1426fb0
SHA1d5883c0df4b9e406043d6821408a1b7f04ca6e90
SHA256a7f0a009a9632d36497a755e2dde9a13255e7251443897c0b8ab2ed42e8b3ff8
SHA512bcdac3a46491c53a95171abd3ca626db5d365aa6dac39368858b9d5ef8e603c82057fd79c9f2443b120dd3306708629d9099602118c9d9a6ca918b6ce6411580
-
Filesize
88KB
MD57957f442388ef62c3b1bf80af7e0d08b
SHA1198d06f45875963c74339420683b4db2e6f16fe7
SHA2561b317eed120f6cc1c51111a62985fc53ada2cc30e0ec380755aadd9de4b9a980
SHA512fe60f448ce5fce04f96abe8cc5238c9d2287b774fac0ea704089e96a9839f9f5d471a237b85cc48488095247cc1f8ab36309233c38af1ff7d0de7ab9cb4928bb
-
Filesize
88KB
MD59b58a72e492d2d1254e7d5de19c7a465
SHA1f0c3d485c5b193b1f48dcec1da26205092be64fd
SHA25679e67d5faa4e2f52347feb33f3d5545fc3458bc198efd0f3bdc638b7480e6240
SHA512d2ab6292de99518309f9524219521f93c86616431b8f300f6b6a61b1860c474ac941dbd8c47a1feef3e69990cfcacf16ecd664fc45dca6c222da1d08a5aa227a
-
Filesize
88KB
MD54e0b74df5467e54532ea9230a3bf2b6a
SHA1fc843bcd40e638f804bcdcc99d857b64453bf90f
SHA25679d1646fc8b565e49cb82ca067e744164e8c02f110d1e953737502fe1604d87e
SHA5122a7df90b5bde4f213d2ca901bb79bfcb8325509de32411c944f39761accd31b1d702e7d4e324f8711613b6113c0e062c921a39125761e7bd26c9b566bc7bd10c
-
Filesize
88KB
MD5512e293a8faea28d3df252e3acf8ff28
SHA1f61861d4f85585cea8e8e115373aff393856d585
SHA2565db83969dc5037da17627873d51fcdbd6dccd08171d323e4eccbeee5ecafb16a
SHA512a08e88e4fbc2adf65583a0c94f853b8f242c70479bbdf2b6d59b30e37791c00d570455e2f066d4a39c96e5f76ec49314b6b9302cb1216c1b81bff28c4dc536ed
-
Filesize
88KB
MD564c7a4ec334e3a50954cd859ddc1477d
SHA13c8869f21fa64f0e18d2f624772044e66dc265fe
SHA25640d6a881a6d29220d7cabdff6e29907ff275f7ae78f00c4dcdd238b84e4639d5
SHA512780c47a4b9e5ebaf3a871af7c129652ed917e10d7ed4d075f12e56c77cdd2b8c4e817c544cbbad767fefbbbb259541f9bce79257fbbb10d3bc4c690bf85099d6
-
Filesize
88KB
MD5fc9acb934a389dbfd49ec3c906271363
SHA1bdf189b7824bfa45fb7faf3aa04e9acbaa93a8f1
SHA256426ed8ec437709293af5256cba796e5eb3b57fcd8602e4cc752929b44070f7cd
SHA5127589735686c221ccc488a588051e9e6f02fb9771560fdecee4aeed0f65e9d8e1f646a54652bff0a60c66c8d10e758ba90ab66f279bf8c9d02e7586710d3390b7
-
Filesize
88KB
MD5ab5329a805fbec65d9e3c1f930a8ee55
SHA179f3c566d25be5a3818b4b518844f259727f760f
SHA256afa960194a5ef533136e49d2d90d2c30afab1e59ab104f9b5fff4fb406268f8d
SHA512aee0a1d556c55267fe899d14b8ed3ecf32528eadca2505f3262755fe464870e2de2dc6d7b23c148ad18977834ac697b37642ed737903aa010c6ac5e9804502f1
-
Filesize
88KB
MD50dda622e3a5fc22e5fe09af8bb4d06ff
SHA1d93b54aea236a85c2cdf5b726eaf4f9c5c005b11
SHA2569a575d6d496ac058eac5f7a8db2dcf641df3e11c8fbe24947fa2a7a411c2cfff
SHA512dc88f95aa28bb84811bcce98013e21bc1632632fa4de6ca267c9c4497889b7f08182bd6702c1ea776a521a1c4457ee1d08625d0d5c01c4f9271ff7c6aa5cd945