Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf
Resource
win10v2004-20240802-en
General
-
Target
fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf
-
Size
884KB
-
MD5
fe9d69fc9e928e62df311b6396286656
-
SHA1
f79d97050e3b5898c476d4b8b08002a58cf96baa
-
SHA256
4e96ee3b819f6b5e357284a6a401efe0ea7a3307d35d0d040452780a472dba3e
-
SHA512
1ed5afc1e1fafa529630a0b1adb9c5e1922de30344bfc104208d9a81e4980505d483f605eab477686b7ee0a02a7a61564671acf6361949c2d15eb8753acf2663
-
SSDEEP
24576:xIRIlfARYEpsJO7oqmxVSxStXIVpdFmkP8Io:n
Malware Config
Extracted
lokibot
http://globalogroup.com/group/glo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2368 2032 cmd.exe 30 Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2896 2032 cmd.exe 30 -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe exe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe exe.exe -
Executes dropped EXE 3 IoCs
pid Process 1900 exe.exe 1500 app.exe 2072 app.exe -
Loads dropped DLL 1 IoCs
pid Process 2452 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook app.exe Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook app.exe Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook app.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1500 set thread context of 2072 1500 app.exe 68 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new exe.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new exe.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new app.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new app.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 34 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
pid Process 2172 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 2788 taskkill.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2032 WINWORD.EXE 1840 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 1900 exe.exe Token: SeDebugPrivilege 1500 app.exe Token: SeDebugPrivilege 2072 app.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 WINWORD.EXE 2032 WINWORD.EXE 2032 WINWORD.EXE 1840 WINWORD.EXE 1840 WINWORD.EXE 1840 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2368 2032 WINWORD.EXE 31 PID 2032 wrote to memory of 2368 2032 WINWORD.EXE 31 PID 2032 wrote to memory of 2368 2032 WINWORD.EXE 31 PID 2032 wrote to memory of 2368 2032 WINWORD.EXE 31 PID 2368 wrote to memory of 2452 2368 cmd.exe 33 PID 2368 wrote to memory of 2452 2368 cmd.exe 33 PID 2368 wrote to memory of 2452 2368 cmd.exe 33 PID 2368 wrote to memory of 2452 2368 cmd.exe 33 PID 2032 wrote to memory of 2896 2032 WINWORD.EXE 34 PID 2032 wrote to memory of 2896 2032 WINWORD.EXE 34 PID 2032 wrote to memory of 2896 2032 WINWORD.EXE 34 PID 2032 wrote to memory of 2896 2032 WINWORD.EXE 34 PID 2452 wrote to memory of 2172 2452 cmd.exe 35 PID 2452 wrote to memory of 2172 2452 cmd.exe 35 PID 2452 wrote to memory of 2172 2452 cmd.exe 35 PID 2452 wrote to memory of 2172 2452 cmd.exe 35 PID 2452 wrote to memory of 1900 2452 cmd.exe 37 PID 2452 wrote to memory of 1900 2452 cmd.exe 37 PID 2452 wrote to memory of 1900 2452 cmd.exe 37 PID 2452 wrote to memory of 1900 2452 cmd.exe 37 PID 2452 wrote to memory of 2788 2452 cmd.exe 38 PID 2452 wrote to memory of 2788 2452 cmd.exe 38 PID 2452 wrote to memory of 2788 2452 cmd.exe 38 PID 2452 wrote to memory of 2788 2452 cmd.exe 38 PID 2452 wrote to memory of 2668 2452 cmd.exe 40 PID 2452 wrote to memory of 2668 2452 cmd.exe 40 PID 2452 wrote to memory of 2668 2452 cmd.exe 40 PID 2452 wrote to memory of 2668 2452 cmd.exe 40 PID 2452 wrote to memory of 2208 2452 cmd.exe 41 PID 2452 wrote to memory of 2208 2452 cmd.exe 41 PID 2452 wrote to memory of 2208 2452 cmd.exe 41 PID 2452 wrote to memory of 2208 2452 cmd.exe 41 PID 2452 wrote to memory of 1380 2452 cmd.exe 42 PID 2452 wrote to memory of 1380 2452 cmd.exe 42 PID 2452 wrote to memory of 1380 2452 cmd.exe 42 PID 2452 wrote to memory of 1380 2452 cmd.exe 42 PID 2452 wrote to memory of 2500 2452 cmd.exe 43 PID 2452 wrote to memory of 2500 2452 cmd.exe 43 PID 2452 wrote to memory of 2500 2452 cmd.exe 43 PID 2452 wrote to memory of 2500 2452 cmd.exe 43 PID 2452 wrote to memory of 1168 2452 cmd.exe 44 PID 2452 wrote to memory of 1168 2452 cmd.exe 44 PID 2452 wrote to memory of 1168 2452 cmd.exe 44 PID 2452 wrote to memory of 1168 2452 cmd.exe 44 PID 2452 wrote to memory of 2868 2452 cmd.exe 45 PID 2452 wrote to memory of 2868 2452 cmd.exe 45 PID 2452 wrote to memory of 2868 2452 cmd.exe 45 PID 2452 wrote to memory of 2868 2452 cmd.exe 45 PID 2452 wrote to memory of 2976 2452 cmd.exe 46 PID 2452 wrote to memory of 2976 2452 cmd.exe 46 PID 2452 wrote to memory of 2976 2452 cmd.exe 46 PID 2452 wrote to memory of 2976 2452 cmd.exe 46 PID 2452 wrote to memory of 1144 2452 cmd.exe 47 PID 2452 wrote to memory of 1144 2452 cmd.exe 47 PID 2452 wrote to memory of 1144 2452 cmd.exe 47 PID 2452 wrote to memory of 1144 2452 cmd.exe 47 PID 2452 wrote to memory of 3000 2452 cmd.exe 48 PID 2452 wrote to memory of 3000 2452 cmd.exe 48 PID 2452 wrote to memory of 3000 2452 cmd.exe 48 PID 2452 wrote to memory of 3000 2452 cmd.exe 48 PID 3000 wrote to memory of 2828 3000 cmd.exe 49 PID 3000 wrote to memory of 2828 3000 cmd.exe 49 PID 3000 wrote to memory of 2828 3000 cmd.exe 49 PID 3000 wrote to memory of 2828 3000 cmd.exe 49 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook app.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook app.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tAsK.bAt2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\2nd.bat3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\timeout.exeTIMEOUT 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\exe.exeC:\Users\Admin\AppData\Local\Temp\ExE.ExE4⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe5⤵
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM winword.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:2668
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:1380
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:2500
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:1168
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f4⤵
- System Location Discovery: System Language Discovery
PID:1144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"4⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"5⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ShowConvertFrom.docx"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1840 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122885⤵PID:2344
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tAsK.bAt2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2468
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2072
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD557ff2666bfc47c63e05d5c182b0f89f3
SHA1c88b20b249b8f4ff963c897e2ba0028e20b316e2
SHA25674249727c5d760e91b9277be58b45a03fd89a587cc19e0b42503b50db2e00356
SHA512a7edf48519bbdf46aee1c5f60e419b4e604d04e3066aa3501e5fe3e81396fc443a4cafe35bdd06770a59e2009d0405dd4c97d8c121cd1bc30987270ad119b8b1
-
Filesize
191B
MD55d65bac473774c66544cc2f4062c9b78
SHA1b2b606f85dd95ff2ab5bcca43966a9c4cbb372b2
SHA2567697184623cf1ffe94e69db38ca0821d3ff2df5826af38a9f7e244f3a725b042
SHA512853ad5701b858fd350bbf2171955d84d551260f883ccc25eb403f4b2606b6694d34c62ade98db0761da8ac3cb3250e98e19e54c3ab7c927782a3a0ed10924cd2
-
Filesize
432B
MD58decdcaeb92d9f628b6bf95de4c0597a
SHA119443ad64921ef01a77619350efcc97cd767a36b
SHA256e4f6b9def338fe9aca9e8796e79c58c5e42168e697c41bfe149946513765036e
SHA512d67fee80c9f4884331e476f53de7516d21e926cf2f00094bf310ccd6e875164740b31749ec1ea43c1015037590b9bfebe2bde0065d75e42343bfbd0c46bccf59
-
Filesize
153B
MD589896bf3dc684cb01d6c9bd8f2df3694
SHA1cd34ddbfe29c70d100f506addf4a6f831079dc01
SHA256429934a64c0d46c46c09c3ccdac2db6801f96e28d072d3dd72ac01c5f023460b
SHA5120f5371dee4db471524b3d6abf8fa673555b9dc92d596e7f3d73d13f810e899d19741cfebd46b09dfde60b0aee9288e2fac3bb8ec5cba3190dabd3bd87a0a29d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\0f5007522459c86e95ffcc62f32308f1_d9071d2c-e5ad-4187-a976-30114bb93bf6
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\0f5007522459c86e95ffcc62f32308f1_d9071d2c-e5ad-4187-a976-30114bb93bf6
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
19KB
MD590612e0651e68b269fe6606d85f5ce58
SHA12d6a9a4ba4acfd71bc1dad175aa202e5a7b33090
SHA256e6455b6a16939015740dc5574cbc329c23b740de021ad52460eca8b558c42747
SHA51219af7d6cdb764143a20e09c2f2b7827249ffba7acdb765c793c7541e9025cd50d8380e9d92ace10d7e98598d22bd26e7da9a82497be2ea7e5aa2a08bd9d776e9
-
Filesize
392B
MD5f2919796198e267a150ed86173156733
SHA15a5a5fb489bbb1c95d01b3f6aef234d9ca520be4
SHA256af54491527986b27210c92e5e62cd0aa0605c49593b0d273a04af077af7aab17
SHA512cc0b410b1b37ff41e2ad06b88cf12af424d022a8de5ceb267b3648f7a7bcd3e82314675652c0373181634a1003727e681f87c3e7d3ba253ef74fd4d35479804a
-
Filesize
386KB
MD5dd67ccac47f6b10075de9c0a9be7a154
SHA142551b5c1abfc9c1b653c9fd36f93cf12541f4c5
SHA256d611d8d6f8e5e8d0f7af9aa1bf58b041139670de1b61253fa461cc84d4fa58f6
SHA512add5d6b23fe7854cfda276f28b4c915176545ddbe8007581860858844262f4efaa361425c775b9b36876731ea19f751326b3ea8c7fdb4e374e7645576f50cf4e