Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/09/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe
Resource
win7-20240903-en
General
-
Target
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe
-
Size
349KB
-
MD5
757472019a584737af67efd5066e8d32
-
SHA1
b85cca049dfc49e0a41ca859a98da0c9c814e318
-
SHA256
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695
-
SHA512
7e9537ebee0c9c34ed3ec6b3b02baa0ad1d85be67473b811c861c85b0651d2dabe96022cc5206ead8549c53ae04e6056040cbd77a605585f11400b395d93d7a6
-
SSDEEP
6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpI+:FB1Q6rpr7MrswfLjGwW5xFdRyJpB
Malware Config
Extracted
nanocore
1.2.2.2
bemery2.no-ip.biz:57628
127.0.0.1:57628
997af15f-5576-4030-975c-eb3264fb6789
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-04-23T21:31:33.540664436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
57628
-
default_group
grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+09
-
mutex
997af15f-5576-4030-975c-eb3264fb6789
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
bemery2.no-ip.biz
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2344 attrib.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Host = "C:\\Program Files (x86)\\ISS Host\\isshost.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2672 set thread context of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\ISS Host\isshost.exe RegAsm.exe File opened for modification C:\Program Files (x86)\ISS Host\isshost.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1656 ping.exe 1532 ping.exe 2452 ping.exe 1548 ping.exe 2180 ping.exe 2820 ping.exe 2360 ping.exe 936 ping.exe 2156 ping.exe 2548 ping.exe 2284 ping.exe 2952 ping.exe 3024 ping.exe 2656 ping.exe 1304 ping.exe 1504 ping.exe 2480 ping.exe 2420 ping.exe 2444 ping.exe 1700 ping.exe -
Runs ping.exe 1 TTPs 20 IoCs
pid Process 2284 ping.exe 2420 ping.exe 1532 ping.exe 2360 ping.exe 936 ping.exe 1304 ping.exe 2656 ping.exe 2156 ping.exe 1700 ping.exe 1548 ping.exe 2480 ping.exe 2180 ping.exe 2952 ping.exe 2820 ping.exe 1504 ping.exe 2548 ping.exe 1656 ping.exe 3024 ping.exe 2452 ping.exe 2444 ping.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1760 RegAsm.exe 1760 RegAsm.exe 1760 RegAsm.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1760 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe Token: SeDebugPrivilege 1760 RegAsm.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2480 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 32 PID 2672 wrote to memory of 2480 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 32 PID 2672 wrote to memory of 2480 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 32 PID 2672 wrote to memory of 2480 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 32 PID 2672 wrote to memory of 1656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 34 PID 2672 wrote to memory of 1656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 34 PID 2672 wrote to memory of 1656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 34 PID 2672 wrote to memory of 1656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 34 PID 2672 wrote to memory of 1532 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 36 PID 2672 wrote to memory of 1532 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 36 PID 2672 wrote to memory of 1532 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 36 PID 2672 wrote to memory of 1532 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 36 PID 2672 wrote to memory of 2284 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 38 PID 2672 wrote to memory of 2284 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 38 PID 2672 wrote to memory of 2284 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 38 PID 2672 wrote to memory of 2284 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 38 PID 2672 wrote to memory of 2180 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 40 PID 2672 wrote to memory of 2180 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 40 PID 2672 wrote to memory of 2180 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 40 PID 2672 wrote to memory of 2180 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 40 PID 2672 wrote to memory of 2952 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 42 PID 2672 wrote to memory of 2952 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 42 PID 2672 wrote to memory of 2952 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 42 PID 2672 wrote to memory of 2952 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 42 PID 2672 wrote to memory of 3024 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 44 PID 2672 wrote to memory of 3024 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 44 PID 2672 wrote to memory of 3024 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 44 PID 2672 wrote to memory of 3024 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 44 PID 2672 wrote to memory of 2820 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 46 PID 2672 wrote to memory of 2820 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 46 PID 2672 wrote to memory of 2820 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 46 PID 2672 wrote to memory of 2820 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 46 PID 2672 wrote to memory of 2452 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 48 PID 2672 wrote to memory of 2452 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 48 PID 2672 wrote to memory of 2452 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 48 PID 2672 wrote to memory of 2452 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 48 PID 2672 wrote to memory of 2656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 50 PID 2672 wrote to memory of 2656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 50 PID 2672 wrote to memory of 2656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 50 PID 2672 wrote to memory of 2656 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 50 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 1760 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 52 PID 2672 wrote to memory of 2344 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 53 PID 2672 wrote to memory of 2344 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 53 PID 2672 wrote to memory of 2344 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 53 PID 2672 wrote to memory of 2344 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 53 PID 2672 wrote to memory of 2360 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 54 PID 2672 wrote to memory of 2360 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 54 PID 2672 wrote to memory of 2360 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 54 PID 2672 wrote to memory of 2360 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 54 PID 2672 wrote to memory of 936 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 57 PID 2672 wrote to memory of 936 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 57 PID 2672 wrote to memory of 936 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 57 PID 2672 wrote to memory of 936 2672 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 57 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2344 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe"C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2480
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1656
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1532
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2284
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2180
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2952
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3024
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2820
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2452
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2344
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2360
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:936
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2420
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1304
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2444
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2156
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1700
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1548
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1504
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2548
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:880
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2604
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2884
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1568
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2320
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2176
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:408
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1476
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1720
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2520
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2876
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD585aa412748cec606260dfc07a2ba0493
SHA1b1604d7f6a3bea2c716137e93c1b3206e4581595
SHA256603e434580ef4df688fa85fa8b0bd552fcc06fa7882c1d2789c8c52bce87752f
SHA51298ffc0676b705619d6fb206459c69cc73de285661971d43311e770898a474c2169749357c3126415f17a19e711badfe0fbbb98f056af8cf99cc6eaad7629a71a
-
Filesize
349KB
MD5eb0f148a424bdc9a5cb600bca18ccfb3
SHA112f2fdf575c8e44013d46c5e282c1680aee4287a
SHA256ac154fc193bcf0ce41d48654d39993a4445aac066f7b2f27e940f27e8106cbaa
SHA5123f7230aae46af806667f16fe938db61ec0ae45dd469e6e58248967949ce53903c3bd1166be793c3a7c83df27fde6fe41984dfb7c0017a34240be7934cd6493a8