Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe
Resource
win7-20240903-en
General
-
Target
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe
-
Size
349KB
-
MD5
757472019a584737af67efd5066e8d32
-
SHA1
b85cca049dfc49e0a41ca859a98da0c9c814e318
-
SHA256
02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695
-
SHA512
7e9537ebee0c9c34ed3ec6b3b02baa0ad1d85be67473b811c861c85b0651d2dabe96022cc5206ead8549c53ae04e6056040cbd77a605585f11400b395d93d7a6
-
SSDEEP
6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpI+:FB1Q6rpr7MrswfLjGwW5xFdRyJpB
Malware Config
Extracted
nanocore
1.2.2.2
bemery2.no-ip.biz:57628
127.0.0.1:57628
997af15f-5576-4030-975c-eb3264fb6789
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-04-23T21:31:33.540664436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
57628
-
default_group
grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+09
-
mutex
997af15f-5576-4030-975c-eb3264fb6789
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
bemery2.no-ip.biz
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 764 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe -
Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1092 set thread context of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\UPNP Subsystem\upnpss.exe RegAsm.exe File opened for modification C:\Program Files (x86)\UPNP Subsystem\upnpss.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4936 ping.exe 3552 ping.exe 312 ping.exe 3716 ping.exe 2612 ping.exe 2608 ping.exe 1384 ping.exe 1836 ping.exe 3988 ping.exe 3436 ping.exe 3976 ping.exe 1864 ping.exe 3336 ping.exe 2656 ping.exe 4088 ping.exe 1796 ping.exe 1508 ping.exe 2484 ping.exe 2364 ping.exe 3732 ping.exe -
Runs ping.exe 1 TTPs 20 IoCs
pid Process 1508 ping.exe 2656 ping.exe 312 ping.exe 3732 ping.exe 4088 ping.exe 3988 ping.exe 4936 ping.exe 3976 ping.exe 1384 ping.exe 2612 ping.exe 3716 ping.exe 1864 ping.exe 2364 ping.exe 1836 ping.exe 2608 ping.exe 3436 ping.exe 3552 ping.exe 3336 ping.exe 2484 ping.exe 1796 ping.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 456 RegAsm.exe 456 RegAsm.exe 456 RegAsm.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 456 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe Token: SeDebugPrivilege 456 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1836 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 82 PID 1092 wrote to memory of 1836 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 82 PID 1092 wrote to memory of 1836 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 82 PID 1092 wrote to memory of 1796 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 84 PID 1092 wrote to memory of 1796 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 84 PID 1092 wrote to memory of 1796 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 84 PID 1092 wrote to memory of 3988 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 90 PID 1092 wrote to memory of 3988 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 90 PID 1092 wrote to memory of 3988 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 90 PID 1092 wrote to memory of 3716 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 93 PID 1092 wrote to memory of 3716 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 93 PID 1092 wrote to memory of 3716 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 93 PID 1092 wrote to memory of 1508 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 97 PID 1092 wrote to memory of 1508 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 97 PID 1092 wrote to memory of 1508 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 97 PID 1092 wrote to memory of 2608 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 99 PID 1092 wrote to memory of 2608 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 99 PID 1092 wrote to memory of 2608 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 99 PID 1092 wrote to memory of 2612 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 101 PID 1092 wrote to memory of 2612 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 101 PID 1092 wrote to memory of 2612 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 101 PID 1092 wrote to memory of 4936 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 103 PID 1092 wrote to memory of 4936 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 103 PID 1092 wrote to memory of 4936 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 103 PID 1092 wrote to memory of 3436 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 107 PID 1092 wrote to memory of 3436 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 107 PID 1092 wrote to memory of 3436 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 107 PID 1092 wrote to memory of 3976 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 109 PID 1092 wrote to memory of 3976 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 109 PID 1092 wrote to memory of 3976 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 109 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 456 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 111 PID 1092 wrote to memory of 764 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 112 PID 1092 wrote to memory of 764 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 112 PID 1092 wrote to memory of 764 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 112 PID 1092 wrote to memory of 1864 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 113 PID 1092 wrote to memory of 1864 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 113 PID 1092 wrote to memory of 1864 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 113 PID 1092 wrote to memory of 1384 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 116 PID 1092 wrote to memory of 1384 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 116 PID 1092 wrote to memory of 1384 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 116 PID 1092 wrote to memory of 3552 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 118 PID 1092 wrote to memory of 3552 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 118 PID 1092 wrote to memory of 3552 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 118 PID 1092 wrote to memory of 2364 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 120 PID 1092 wrote to memory of 2364 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 120 PID 1092 wrote to memory of 2364 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 120 PID 1092 wrote to memory of 3336 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 122 PID 1092 wrote to memory of 3336 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 122 PID 1092 wrote to memory of 3336 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 122 PID 1092 wrote to memory of 2656 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 124 PID 1092 wrote to memory of 2656 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 124 PID 1092 wrote to memory of 2656 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 124 PID 1092 wrote to memory of 312 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 126 PID 1092 wrote to memory of 312 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 126 PID 1092 wrote to memory of 312 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 126 PID 1092 wrote to memory of 3732 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 128 PID 1092 wrote to memory of 3732 1092 02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe 128 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 764 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe"C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1836
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1796
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3988
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3716
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2608
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2612
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4936
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3436
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3976
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\02f93de1f29e13cd5c44712c749b2a190ba9457fd2937e719f3ebaa8fa331695.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:764
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1864
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1384
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3552
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2364
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3336
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2656
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:312
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3732
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4088
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2484
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5104
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4872
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4400
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4504
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4948
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4532
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1780
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4452
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:220
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4376
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4536
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3320
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4600
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1980
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD551c9dd5b95cc8797b5a2bc0ebc938e04
SHA1f721fc12e99413bf24e0598c19d73158d6be6ec5
SHA2566978c6b10d8792f180d676062a8c96263ef0d8f37bb4726edfe5f1e51908960a
SHA512a1070d16b87c7428ff762f4c563618eda732bbd4849dd9cdee412884e3331c736d25d77ace0cd72a2d5b600029791bbac7ef970c950ccddb82a00138005d561f