Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240729-en
General
-
Target
file.exe
-
Size
292KB
-
MD5
0c4b826cab211945649ac4bbb0c48c6b
-
SHA1
fe0132f85b63833f55a41651fcc0f32c1c96124d
-
SHA256
41b381e462f4108957fbab888701dfb9e605621507f8dd2d3f71a32b429c5f0c
-
SHA512
6e4ea6a514002c61cadfea41ae6aa9e81178570dbae5f78b79e95f654dc6c7716a8f98b812c805ad45423f0e657fab260492e46b2e6bb45d25520d933dc27363
-
SSDEEP
6144:D8zag1zxFKmMqtXpA8dI41MwJckA3/l6ah4LXeofOdLBhShSpk+JEO:OjNxjXrX1z1845DdfCLBxZEO
Malware Config
Extracted
vidar
https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
Extracted
lumma
https://questionmwq.shop/api
https://chickerkuso.shop/api
https://achievenmtynwjq.shop/api
https://puredoffustow.shop/api
https://opponnentduei.shop/api
https://metallygaricwo.shop/api
https://milldymarskwom.shop/api
https://quotamkdsdqo.shop/api
https://carrtychaintnyw.shop/api
Signatures
-
Detect Vidar Stealer 22 IoCs
resource yara_rule behavioral1/memory/2788-13-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-10-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-8-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-9-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-18-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-17-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-159-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-178-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-212-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-231-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-362-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-381-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-424-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2788-443-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-606-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-604-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-603-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-600-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-598-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-596-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-713-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 behavioral1/memory/2200-732-0x0000000000400000-0x0000000000657000-memory.dmp family_vidar_v7 -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3004 EHJDHJKFIE.exe 2364 GDGHJEHJJD.exe -
Loads dropped DLL 10 IoCs
pid Process 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2640 set thread context of 2788 2640 file.exe 31 PID 3004 set thread context of 632 3004 EHJDHJKFIE.exe 40 PID 2364 set thread context of 2200 2364 GDGHJEHJJD.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHJDHJKFIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDGHJEHJJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2580 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2788 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe 2200 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2640 wrote to memory of 2788 2640 file.exe 31 PID 2788 wrote to memory of 3004 2788 RegAsm.exe 34 PID 2788 wrote to memory of 3004 2788 RegAsm.exe 34 PID 2788 wrote to memory of 3004 2788 RegAsm.exe 34 PID 2788 wrote to memory of 3004 2788 RegAsm.exe 34 PID 2788 wrote to memory of 2364 2788 RegAsm.exe 36 PID 2788 wrote to memory of 2364 2788 RegAsm.exe 36 PID 2788 wrote to memory of 2364 2788 RegAsm.exe 36 PID 2788 wrote to memory of 2364 2788 RegAsm.exe 36 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 2260 3004 EHJDHJKFIE.exe 38 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 836 3004 EHJDHJKFIE.exe 39 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 3004 wrote to memory of 632 3004 EHJDHJKFIE.exe 40 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2364 wrote to memory of 2200 2364 GDGHJEHJJD.exe 41 PID 2788 wrote to memory of 2800 2788 RegAsm.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\ProgramData\EHJDHJKFIE.exe"C:\ProgramData\EHJDHJKFIE.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2260
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:836
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:632
-
-
-
C:\ProgramData\GDGHJEHJJD.exe"C:\ProgramData\GDGHJEHJJD.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCFBKKKFHCF" & exit3⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2580
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize471B
MD5e4c9c228deb34fd1cfe809ad5d511938
SHA18bc49f78d86ba765d25d13e40dfeaa719c5cd6a4
SHA256fb5db2210730bc192f671fa5786693678ea904d914aab03d09232a1c07acd5b5
SHA51241f2e064008763af4512292d784daf27300b857add60dc5417bb6a9389e80b6863681d00e3e67b62686962c8f0f9afd7311ed028dc2f59e1d73174432ead1b69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fcdef6ac1bd03c73269e5fe7aa98aad2
SHA1bde12ccb2ad44327afdf7e5998a5d8b97871a9ed
SHA25619605028d116537d5e466e6baa37536b62178b2f668c808d25e6e69d186bd198
SHA51262ab8b60f686ff15ea9d7990f8f49333645022c853a69a31cda9f15489c7d2441ce2fb9321f042e2be41b0ae363e8aadf55abe01c77eaf31e1e80b555dd17c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Filesize400B
MD55ae62f7f9da4343cd21aaad86c3501f1
SHA1027937f56d354d63cd0f80f295f4166b6bd9cc55
SHA25684344794c11258027bd7f46fb385b8dcb12a7e23dac4b771b0cb01447ec6ac93
SHA512d06d124e4f7f89203edcdd2cca87cc4c2a98ffe79339660b86a4d285ca9753611f31a83eec7affef12ebb83de9bb5d967c7bf15903d6b828e92c58ae278ad0fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\76561199768374681[1].htm
Filesize33KB
MD5108ef984013d36a48ce1d38dca7c147e
SHA156b0f8f9b2f18470e675b9b689e94aba360fb2ac
SHA2567ce59f85ad964b4b4203415fbbdf9dbcda8fcc34f3addd0c0e9c3846adc2a2aa
SHA51203cc8713e9be93d718b9297f07826b07386d9c10af45779757e026ab8ebafdfce2c370ed51a1e50da14b1a456858b184bfc4fb5f8eac0a2968104afca53b5c41
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
354KB
MD5384a847ad2833788fa253433fd2eea8d
SHA11984d8788fe40bd95a90d7d4e9dea6c4e4ff6201
SHA256de30491736617249b3e80fc9436ecf0f7675b3c3014509398c3db7298f93336a
SHA512bcdbd44837629d8881c29a7c7f6a2d4e98b52fbc49952bad2c89340a1dee18fac9987aaa8a3d91905a1f88a216c0e2501201a8665f3df7d5f627ff71a2418aac
-
Filesize
292KB
MD54a8a0ccfecc930091116324c79c1006e
SHA1d790befcbc31a4befafeaf08879e15f99633b2a1
SHA256146b7006b041d25b6846c797234f38387ec4b141c4a7e4f100d0e6d2eda29088
SHA512ffef04766c2a9f9d038ccf6156ac7f03a0e0809adaf245a1347e5ece6ad31f9b37f283d71d34c031350456f30036078d5a3e97fa563bf6af6a8fcf6edeeb25d2
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571