Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/09/2024, 02:47
240915-c94dhssaqq 6Analysis
-
max time kernel
85s -
max time network
26s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 02:47
Static task
static1
Behavioral task
behavioral1
Sample
DualMonitorTools-2.11.msi
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
DualMonitorTools-2.11.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
DualMonitorTools-2.11.msi
-
Size
688KB
-
MD5
80e31e792ee128b5ce1ad32acc14bf6e
-
SHA1
78b8dffcb6a4b1b234b730142f8251e0393cdec0
-
SHA256
9f680d10df37f6b04bace9fede8e031849fa5c8f257f7aa8a6974f94edc15874
-
SHA512
602663680368c9d5e649f5ae5619bb66a6330a6f653940cc117118b0414cdcad39e5d5f94a0d74f27edf0805afd07d96fae34c8fa85f11b4120654b6482c7d21
-
SSDEEP
12288:dyqm9jHjAsdIcnkvkOvjStgGuMWFM6ZNLbp:dyqmNssfnkvdQg3MW/nv
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\DmtWallpaper.scr msiexec.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Dual Monitor Tools\DmtFileLocations.xml msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\README.txt msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\THANKS.txt msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\CHANGES.txt msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\COPYING.txt msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\DMT.exe msiexec.exe File created C:\Program Files (x86)\Dual Monitor Tools\DualWallpaper.exe msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76d46f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f76d472.msi msiexec.exe File opened for modification C:\Windows\Installer\f76d470.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f76d46f.msi msiexec.exe File created C:\Windows\Installer\f76d470.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID549.tmp msiexec.exe -
Executes dropped EXE 3 IoCs
pid Process 1636 DMT.exe 1204 DualWallpaper.exe 888 DMT.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2256 msiexec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E89112BE8AE823E4E82ED3C5813C4E9B\DualWallpaper = "Complete" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\PackageName = "DualMonitorTools-2.11.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E89112BE8AE823E4E82ED3C5813C4E9B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E89112BE8AE823E4E82ED3C5813C4E9B\DmtWallpaper = "Complete" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\PackageCode = "40D6F3E621E3FF7409152F100233DD77" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\Version = "34275328" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7BA1CEA9AED2D374084E7D495A716692 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E89112BE8AE823E4E82ED3C5813C4E9B\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\ProductName = "Dual Monitor Tools" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7BA1CEA9AED2D374084E7D495A716692\E89112BE8AE823E4E82ED3C5813C4E9B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E89112BE8AE823E4E82ED3C5813C4E9B\SourceList\Media msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2224 msiexec.exe 2224 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2256 msiexec.exe Token: SeIncreaseQuotaPrivilege 2256 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2256 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2256 msiexec.exe Token: SeLockMemoryPrivilege 2256 msiexec.exe Token: SeIncreaseQuotaPrivilege 2256 msiexec.exe Token: SeMachineAccountPrivilege 2256 msiexec.exe Token: SeTcbPrivilege 2256 msiexec.exe Token: SeSecurityPrivilege 2256 msiexec.exe Token: SeTakeOwnershipPrivilege 2256 msiexec.exe Token: SeLoadDriverPrivilege 2256 msiexec.exe Token: SeSystemProfilePrivilege 2256 msiexec.exe Token: SeSystemtimePrivilege 2256 msiexec.exe Token: SeProfSingleProcessPrivilege 2256 msiexec.exe Token: SeIncBasePriorityPrivilege 2256 msiexec.exe Token: SeCreatePagefilePrivilege 2256 msiexec.exe Token: SeCreatePermanentPrivilege 2256 msiexec.exe Token: SeBackupPrivilege 2256 msiexec.exe Token: SeRestorePrivilege 2256 msiexec.exe Token: SeShutdownPrivilege 2256 msiexec.exe Token: SeDebugPrivilege 2256 msiexec.exe Token: SeAuditPrivilege 2256 msiexec.exe Token: SeSystemEnvironmentPrivilege 2256 msiexec.exe Token: SeChangeNotifyPrivilege 2256 msiexec.exe Token: SeRemoteShutdownPrivilege 2256 msiexec.exe Token: SeUndockPrivilege 2256 msiexec.exe Token: SeSyncAgentPrivilege 2256 msiexec.exe Token: SeEnableDelegationPrivilege 2256 msiexec.exe Token: SeManageVolumePrivilege 2256 msiexec.exe Token: SeImpersonatePrivilege 2256 msiexec.exe Token: SeCreateGlobalPrivilege 2256 msiexec.exe Token: SeBackupPrivilege 2836 vssvc.exe Token: SeRestorePrivilege 2836 vssvc.exe Token: SeAuditPrivilege 2836 vssvc.exe Token: SeBackupPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2328 DrvInst.exe Token: SeLoadDriverPrivilege 2328 DrvInst.exe Token: SeLoadDriverPrivilege 2328 DrvInst.exe Token: SeLoadDriverPrivilege 2328 DrvInst.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2256 msiexec.exe 2256 msiexec.exe 1636 DMT.exe 1636 DMT.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1636 DMT.exe 1636 DMT.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1636 2256 msiexec.exe 36 PID 2256 wrote to memory of 1636 2256 msiexec.exe 36 PID 2256 wrote to memory of 1636 2256 msiexec.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DualMonitorTools-2.11.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files (x86)\Dual Monitor Tools\DMT.exe"C:\Program Files (x86)\Dual Monitor Tools\DMT.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1636
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000005A4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
C:\Program Files (x86)\Dual Monitor Tools\DualWallpaper.exe"C:\Program Files (x86)\Dual Monitor Tools\DualWallpaper.exe"1⤵
- Executes dropped EXE
PID:1204
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2280
-
C:\Program Files (x86)\Dual Monitor Tools\DMT.exe"C:\Program Files (x86)\Dual Monitor Tools\DMT.exe"1⤵
- Executes dropped EXE
PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5cae38946db420743b224ab4575167033
SHA1f9bd4209f3a9ca8ca853bfe764f576ab35d87875
SHA256b20aa0c8a166d03bc686f70076837cd43740a07b659aa6f308a459bd23afa487
SHA512de81bd44a7290c082ca70f55579aa75c84c29f8f5e42934eca8852b206a7d926529164bc4bf5080e329617895ae7cb8660ef6970fc4693b105d094f1047d3813
-
Filesize
940KB
MD58a997c77aaf98e26ced82a8436400bc4
SHA18290479cd478485bac4a09d208e446c87f0f0920
SHA2564a555ab14b164626b0c3d5603d02b9dc251f0248fb5130ba5b602511e5827329
SHA5125af39961f8f62161225ad441fa806fd1841b671a06cb0fc2ceb5becb504010a7724a584fc8b4016e0e0005450c5329c27d7056d59fb68b5bfac775d30e50cb27
-
Filesize
1KB
MD5342eef7bf0d15025d415b861e92484b8
SHA15eefb15d3ae6bbc6ba072653b7df7cd904da9a48
SHA256b6fa2dc6561f84458d018d4d4b1d36a80942d20e9469ae78499da9be5e623d1e
SHA51299fb3bda81cff56d21feb6de973b34ac3af698cbf9cb14d683ab5e6f74b148092af2350d60c72728cd8c4ef7d0eb63b35eac58fe12394dd022af2370c7971898
-
Filesize
108KB
MD59321c562e70b074fb477cc534e0b04fc
SHA18aa722c8859d32b6f32021b05c1fc588e218e35a
SHA256d62361f2853da8e001246754f60686ad784a3473fe18da2450546f84b4f36e20
SHA5122c1334920d5ecdbe4e7cc74543c206e259d617ea64f562a7fc965e0d84af98f8984b48224ee81b65432691dfab3765f3c825ed8787941113f4001c2bcbf7df4c
-
Filesize
688KB
MD580e31e792ee128b5ce1ad32acc14bf6e
SHA178b8dffcb6a4b1b234b730142f8251e0393cdec0
SHA2569f680d10df37f6b04bace9fede8e031849fa5c8f257f7aa8a6974f94edc15874
SHA512602663680368c9d5e649f5ae5619bb66a6330a6f653940cc117118b0414cdcad39e5d5f94a0d74f27edf0805afd07d96fae34c8fa85f11b4120654b6482c7d21