Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

5

c4b92f45b2...aN.exe

windows7-x64

7

c4b92f45b2...aN.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 07:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c4b92f45b28fe30ca4c9d637b78ec878852ba4c8036312591446149ef0c3fefaN.exe

  • Size

    260KB

  • MD5

    cae51f7214ea8290c72288d86693b160

  • SHA1

    e32478386fbb7d2307d3f7df9f18d842db70f5a3

  • SHA256

    c4b92f45b28fe30ca4c9d637b78ec878852ba4c8036312591446149ef0c3fefa

  • SHA512

    7bb34ed2887a941c6b47591d4d5fbbb55cd43bf308b16b60e25f9ac4cfbd8ca25c9e7c9bf31e8dc41629787e0dfb86f4db77aa0bac4d6eaa465961508664ee4a

  • SSDEEP

    1536:GxtnE6acoso8vzxoSBUES5SwziMYiHzhtAia5QrMsQtCnt8qiJPQsZSTorlN33nn:K/vFYi9yQct1iJPQSrl1LtYFroxTSfY

Score
7/10
discoverypersistenceupx

Malware Config

Signatures

  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4b92f45b28fe30ca4c9d637b78ec878852ba4c8036312591446149ef0c3fefaN.exe
    "C:\Users\Admin\AppData\Local\Temp\c4b92f45b28fe30ca4c9d637b78ec878852ba4c8036312591446149ef0c3fefaN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\SysWOW64\b2x6d.exe
      "C:\Windows\system32\b2x6d.exe" killauto~~c4b92f45b28fe30ca4c9d637b78ec878852ba4c8036312591446149ef0c3fefaN.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Windows\SysWOW64\543ee.exe
        "C:\Windows\system32\543ee.exe" killauto~~b2x6d.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\31bb6.exe
          "C:\Windows\system32\31bb6.exe" killauto~~543ee.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2408
          • C:\Windows\SysWOW64\4e3d4.exe
            "C:\Windows\system32\4e3d4.exe" killauto~~31bb6.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Windows\SysWOW64\29284.exe
              "C:\Windows\system32\29284.exe" killauto~~4e3d4.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:312
              • C:\Windows\SysWOW64\8616d.exe
                "C:\Windows\system32\8616d.exe" killauto~~29284.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:804
                • C:\Windows\SysWOW64\290b8.exe
                  "C:\Windows\system32\290b8.exe" killauto~~8616d.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2156
                  • C:\Windows\SysWOW64\7e73b.exe
                    "C:\Windows\system32\7e73b.exe" killauto~~290b8.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2924
                    • C:\Windows\SysWOW64\5a389.exe
                      "C:\Windows\system32\5a389.exe" killauto~~7e73b.exe
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:776
                      • C:\Windows\SysWOW64\exd76.exe
                        "C:\Windows\system32\exd76.exe" killauto~~5a389.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1640
                        • C:\Windows\SysWOW64\456x9.exe
                          "C:\Windows\system32\456x9.exe" killauto~~exd76.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1244
                          • C:\Windows\SysWOW64\22ec1.exe
                            "C:\Windows\system32\22ec1.exe" killauto~~456x9.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1756
                            • C:\Windows\SysWOW64\77643.exe
                              "C:\Windows\system32\77643.exe" killauto~~22ec1.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1700
                              • C:\Windows\SysWOW64\77484.exe
                                "C:\Windows\system32\77484.exe" killauto~~77643.exe
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2916
                                • C:\Windows\SysWOW64\be246.exe
                                  "C:\Windows\system32\be246.exe" killauto~~77484.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:2788
                                  • C:\Windows\SysWOW64\514e0.exe
                                    "C:\Windows\system32\514e0.exe" killauto~~be246.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2620
                                    • C:\Windows\SysWOW64\bcb2x.exe
                                      "C:\Windows\system32\bcb2x.exe" killauto~~514e0.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2992
                                      • C:\Windows\SysWOW64\9867d.exe
                                        "C:\Windows\system32\9867d.exe" killauto~~bcb2x.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2820
                                        • C:\Windows\SysWOW64\a7ab4.exe
                                          "C:\Windows\system32\a7ab4.exe" killauto~~9867d.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2604
                                          • C:\Windows\SysWOW64\03a81.exe
                                            "C:\Windows\system32\03a81.exe" killauto~~a7ab4.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2252
                                            • C:\Windows\SysWOW64\edb42.exe
                                              "C:\Windows\system32\edb42.exe" killauto~~03a81.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1056
                                              • C:\Windows\SysWOW64\45d62.exe
                                                "C:\Windows\system32\45d62.exe" killauto~~edb42.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1100
                                                • C:\Windows\SysWOW64\d9bc9.exe
                                                  "C:\Windows\system32\d9bc9.exe" killauto~~45d62.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2124
                                                  • C:\Windows\SysWOW64\45ca7.exe
                                                    "C:\Windows\system32\45ca7.exe" killauto~~d9bc9.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:904
                                                    • C:\Windows\SysWOW64\441dc.exe
                                                      "C:\Windows\system32\441dc.exe" killauto~~45ca7.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:940
                                                      • C:\Windows\SysWOW64\e668a.exe
                                                        "C:\Windows\system32\e668a.exe" killauto~~441dc.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1640
                                                        • C:\Windows\SysWOW64\c3d6d.exe
                                                          "C:\Windows\system32\c3d6d.exe" killauto~~e668a.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1932
                                                          • C:\Windows\SysWOW64\7510a.exe
                                                            "C:\Windows\system32\7510a.exe" killauto~~c3d6d.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2152
                                                            • C:\Windows\SysWOW64\502bb.exe
                                                              "C:\Windows\system32\502bb.exe" killauto~~7510a.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2704
                                                              • C:\Windows\SysWOW64\88b2b.exe
                                                                "C:\Windows\system32\88b2b.exe" killauto~~502bb.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2396
                                                                • C:\Windows\SysWOW64\74679.exe
                                                                  "C:\Windows\system32\74679.exe" killauto~~88b2b.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3000
                                                                  • C:\Windows\SysWOW64\2506c.exe
                                                                    "C:\Windows\system32\2506c.exe" killauto~~74679.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2800
                                                                    • C:\Windows\SysWOW64\dd1ee.exe
                                                                      "C:\Windows\system32\dd1ee.exe" killauto~~2506c.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2676
                                                                      • C:\Windows\SysWOW64\7213a.exe
                                                                        "C:\Windows\system32\7213a.exe" killauto~~dd1ee.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2320
                                                                        • C:\Windows\SysWOW64\354d7.exe
                                                                          "C:\Windows\system32\354d7.exe" killauto~~7213a.exe
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2212
                                                                          • C:\Windows\SysWOW64\c90b7.exe
                                                                            "C:\Windows\system32\c90b7.exe" killauto~~354d7.exe
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2208
                                                                            • C:\Windows\SysWOW64\c87x2.exe
                                                                              "C:\Windows\system32\c87x2.exe" killauto~~c90b7.exe
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2052
                                                                              • C:\Windows\SysWOW64\b3692.exe
                                                                                "C:\Windows\system32\b3692.exe" killauto~~c87x2.exe
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1960
                                                                                • C:\Windows\SysWOW64\57272.exe
                                                                                  "C:\Windows\system32\57272.exe" killauto~~b3692.exe
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2576
                                                                                  • C:\Windows\SysWOW64\8900d.exe
                                                                                    "C:\Windows\system32\8900d.exe" killauto~~57272.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1800
                                                                                    • C:\Windows\SysWOW64\2b2c3.exe
                                                                                      "C:\Windows\system32\2b2c3.exe" killauto~~8900d.exe
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1104
                                                                                      • C:\Windows\SysWOW64\4169d.exe
                                                                                        "C:\Windows\system32\4169d.exe" killauto~~2b2c3.exe
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1520
                                                                                        • C:\Windows\SysWOW64\d4504.exe
                                                                                          "C:\Windows\system32\d4504.exe" killauto~~4169d.exe
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1592
                                                                                          • C:\Windows\SysWOW64\7287a.exe
                                                                                            "C:\Windows\system32\7287a.exe" killauto~~d4504.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2768
                                                                                            • C:\Windows\SysWOW64\95xbx.exe
                                                                                              "C:\Windows\system32\95xbx.exe" killauto~~7287a.exe
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2952
                                                                                              • C:\Windows\SysWOW64\1654e.exe
                                                                                                "C:\Windows\system32\1654e.exe" killauto~~95xbx.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2060
                                                                                                • C:\Windows\SysWOW64\a5363.exe
                                                                                                  "C:\Windows\system32\a5363.exe" killauto~~1654e.exe
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2840
                                                                                                  • C:\Windows\SysWOW64\eb687.exe
                                                                                                    "C:\Windows\system32\eb687.exe" killauto~~a5363.exe
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2972
                                                                                                    • C:\Windows\SysWOW64\4868c.exe
                                                                                                      "C:\Windows\system32\4868c.exe" killauto~~eb687.exe
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:1164
                                                                                                      • C:\Windows\SysWOW64\ea82a.exe
                                                                                                        "C:\Windows\system32\ea82a.exe" killauto~~4868c.exe
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in System32 directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2284
                                                                                                        • C:\Windows\SysWOW64\9e781.exe
                                                                                                          "C:\Windows\system32\9e781.exe" killauto~~ea82a.exe
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2460
                                                                                                          • C:\Windows\SysWOW64\1d42e.exe
                                                                                                            "C:\Windows\system32\1d42e.exe" killauto~~9e781.exe
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2244
                                                                                                            • C:\Windows\SysWOW64\e9e7c.exe
                                                                                                              "C:\Windows\system32\e9e7c.exe" killauto~~1d42e.exe
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2076
                                                                                                              • C:\Windows\SysWOW64\40x99.exe
                                                                                                                "C:\Windows\system32\40x99.exe" killauto~~e9e7c.exe
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:760
                                                                                                                • C:\Windows\SysWOW64\beed9.exe
                                                                                                                  "C:\Windows\system32\beed9.exe" killauto~~40x99.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:924
                                                                                                                  • C:\Windows\SysWOW64\x7859.exe
                                                                                                                    "C:\Windows\system32\x7859.exe" killauto~~beed9.exe
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:2352
                                                                                                                    • C:\Windows\SysWOW64\a9be6.exe
                                                                                                                      "C:\Windows\system32\a9be6.exe" killauto~~x7859.exe
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2124
                                                                                                                      • C:\Windows\SysWOW64\cc247.exe
                                                                                                                        "C:\Windows\system32\cc247.exe" killauto~~a9be6.exe
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2908
                                                                                                                        • C:\Windows\SysWOW64\a9a2b.exe
                                                                                                                          "C:\Windows\system32\a9a2b.exe" killauto~~cc247.exe
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:2392
                                                                                                                          • C:\Windows\SysWOW64\48dbd.exe
                                                                                                                            "C:\Windows\system32\48dbd.exe" killauto~~a9a2b.exe
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Adds Run key to start application
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:2356
                                                                                                                            • C:\Windows\SysWOW64\c7915.exe
                                                                                                                              "C:\Windows\system32\c7915.exe" killauto~~48dbd.exe
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1796
                                                                                                                              • C:\Windows\SysWOW64\c7915.exe
                                                                                                                                "C:\Windows\system32\c7915.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\543ee.exe
    Filesize

    260KB

    MD5

    9317267e6478fb7762884d1cd7f26c98

    SHA1

    d4638296e67f4df7cbfa050f7301d97e46328eee

    SHA256

    974303e8e45261a7570a8a9d631c2aefe791aeecdb9339052a099d51c03f5b27

    SHA512

    7251577c1482d53163a8344d58b28db82b2a64f57ceb5f48deaa0e176e86e4c0fb523f3f34d7800efd34255ae0cdef2a459a707eb84c041b6d18073b7764389f

    Download Submit

  • \Windows\SysWOW64\22ec1.exe
    Filesize

    260KB

    MD5

    82a2cb2265c282348703609f1184fdf9

    SHA1

    8bc16662bc58535733da3e22577fa1de94cb7155

    SHA256

    2739b58674e6b94c6c33728c7419dca9cc57db19dd0e7940d2aef17e531cf382

    SHA512

    bea920477f19a229b196561686cdc95152966cba3ee297c59bc92bb74b0c3c3b8fabf73f6445785abfad8a6f6965a4a3943347fbd622e935c0aa11676fa9c80c

    Download Submit

  • \Windows\SysWOW64\290b8.exe
    Filesize

    260KB

    MD5

    e2bb265f152d102b82c7065c44fe98db

    SHA1

    bd608f7aa3d7764fb4c5c9796e422a874c714d2c

    SHA256

    4bca885fa977521934fef7eaab808525acfa42c1bcd5d6b6de07ff09b869fd67

    SHA512

    7d07b663e965c2294d309a7614d5b6130431b9a556cbc054011998ab56d0853519a42427e4e233649e24decd4b41e4fdb7157e62eb0137a86d667949a1300083

    Download Submit

  • \Windows\SysWOW64\29284.exe
    Filesize

    260KB

    MD5

    5ee7cf162abfc3b823f8c816da5734a1

    SHA1

    6c38049b03292257466d994468cb699064832c55

    SHA256

    7ce3da78ac1fadc0c0239b156034f2b226c1a92983c6bb64eb6de182f10223c5

    SHA512

    c20d7e92788096f2968480f72b63084eba26933327003d28c69d1e135dee98a89fcb28c2c18286c681a831e0bab04f2eb0af0ea5eb1e7a996e7f59775a76b993

    Download Submit

  • \Windows\SysWOW64\31bb6.exe
    Filesize

    260KB

    MD5

    a6f73ef37c2e021f45cb333f72d41c7f

    SHA1

    513dd1235341b9805ace5eb27851cd5580ae858e

    SHA256

    7ffd3a9c7017d80836bedf7ceb896c3235d0efed21195a55ed58111a6cd9807b

    SHA512

    397ac93dc50a014e00805f37d9fd702a4f73998a5a8c8d0df9e8dca345d7223dee450ed456e428d5ca85f6009f4604ef4a010432b799527a042c8eb391a8cb8f

    Download Submit

  • \Windows\SysWOW64\77484.exe
    Filesize

    260KB

    MD5

    bb3b6a989a68c767df49d9e89b821b2a

    SHA1

    76dc57151ee52a430a718acbfcb758f78f8688c0

    SHA256

    8eefc1b8bd66db4cccda8ffef22d9293a141108b525ee5589dd2a37f5b6ce68e

    SHA512

    92ef0d3227beb96dcf99ed467359d72f3ee81d7808d6e325377015f760801a87ac458b79cf95c8d5a13ccc77d5250c1b5a04c1dd6f9eaceef93ac657887aa2f1

    Download Submit

  • \Windows\SysWOW64\7e73b.exe
    Filesize

    260KB

    MD5

    2efb22e5022f66522662b4e344ab8ef4

    SHA1

    2638c211d344f07178c3add15038d7e2008cd72f

    SHA256

    da075b2e3897aaf34c985b4e47ac94263856440d2d3ed3052296ac3f3b40d59e

    SHA512

    ea486726a9e4fab1c47108a78c25a3a243694b540a38644b56560d1b34b07df57093afa38ca23f8888b88e6aa1fdb0a29de179e273f3b65e49db2d053be72fe6

    Download Submit

  • \Windows\SysWOW64\8616d.exe
    Filesize

    260KB

    MD5

    7a9a550432b7e3a11f8d5e980de3b6b1

    SHA1

    25d62f2c060000840d6728901a239cc22d6d8918

    SHA256

    4ce9465386ea215b33da879c860016e3072bb68f4d32b2096a33b7ba3e3f1179

    SHA512

    bddbdee0c26cbad0df609f658a844b51eca6f466e41fa22cd7f6076ca41dbf68078bfe55181d6d16a74d604ab8300de2872cb170fe0d2c05ea5c3340d0d61666

    Download Submit

  • \Windows\SysWOW64\b2x6d.exe
    Filesize

    260KB

    MD5

    a416f4f26acc48824cc8d47c258a8df6

    SHA1

    cee33c46a593f3efc015c533ef920385a4786ab2

    SHA256

    accb597f6b0efea289315e5a93965a0e88ec3b1bd8aa3c4bcbf1398827feadf5

    SHA512

    096aae3858409ead85fbd545b00b77b20c21fed357f77ded9ed3fe3a718a1a66f3a4b85b8d40b5358d6d5b3715f6b1d26825aeb1d3395e9685613ed8a84af212

    Download Submit

  • \Windows\SysWOW64\be246.exe
    Filesize

    260KB

    MD5

    5e9003d6a23b679e48b44f11a473ac35

    SHA1

    7787f8b50a7d1588e59bdf082a06c8c18e6c8a4a

    SHA256

    e68469f3e1ed712fed2397f9f5cdf7cc769b245ed4fe3a46c2eb256a5a99ee76

    SHA512

    9abda1c9ad21e2319160447194670be97e2022dfa769c4f3c5bba6914c5d7989210829560b806207becf6ec594aeffb07345e7d260252dff8ee9f3d6daa0c012

    Download Submit

  • \Windows\SysWOW64\exd76.exe
    Filesize

    260KB

    MD5

    e2c767a23fbb335d3d9b61dcb2609c0f

    SHA1

    b8938997ad72275c50bf2383fc8703cd8d733e3c

    SHA256

    68ecb80a502bd8b471a371e9eedd7daf394814dad93fb2f9d21cc8a2f5bf45ab

    SHA512

    4e67e04093041422b95d123df5d1a2d7987cc7766622df4016bff2f0b7a2a2d73abbd1d75dff681c9dccc2836321530b0f56756cb37d8726d12d745b206d663c

    Download Submit

  • memory/312-99-0x0000000003F20000-0x0000000003F62000-memory.dmp

    Filesize

    264KB

    Download

  • memory/312-101-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/760-707-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/760-705-0x0000000003BD0000-0x0000000003C12000-memory.dmp

    Filesize

    264KB

    Download

  • memory/776-167-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/776-166-0x0000000003F80000-0x0000000003FC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/776-165-0x0000000003F80000-0x0000000003FC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/804-116-0x0000000003C50000-0x0000000003C92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/804-118-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/904-361-0x0000000003B70000-0x0000000003BB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/924-718-0x0000000003AB0000-0x0000000003AF2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/924-714-0x0000000003AB0000-0x0000000003AF2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/940-373-0x0000000003D00000-0x0000000003D42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/940-372-0x0000000003D00000-0x0000000003D42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1056-328-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1056-318-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1056-324-0x0000000003C80000-0x0000000003CC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1100-339-0x0000000003BD0000-0x0000000003C12000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1104-560-0x0000000003C80000-0x0000000003CC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1164-648-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1164-649-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1244-199-0x0000000003EA0000-0x0000000003EE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1592-581-0x0000000003C00000-0x0000000003C42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1640-183-0x0000000003B10000-0x0000000003B52000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1640-187-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1640-384-0x0000000003CC0000-0x0000000003D02000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1700-231-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1756-215-0x0000000003E30000-0x0000000003E72000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1756-219-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1800-549-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1800-547-0x0000000003CC0000-0x0000000003D02000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1800-548-0x0000000003CC0000-0x0000000003D02000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1932-395-0x0000000003BA0000-0x0000000003BE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1960-523-0x0000000003A50000-0x0000000003A92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1960-524-0x0000000003A50000-0x0000000003A92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2052-512-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2052-511-0x0000000003D30000-0x0000000003D72000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2056-33-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2056-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2056-31-0x0000000003EA0000-0x0000000003EE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2056-30-0x0000000003EA0000-0x0000000003EE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2060-615-0x0000000003B70000-0x0000000003BB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2076-694-0x0000000003E40000-0x0000000003E82000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2076-693-0x0000000003E40000-0x0000000003E82000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2124-350-0x0000000003B50000-0x0000000003B92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2152-403-0x0000000003D00000-0x0000000003D42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2156-134-0x0000000003CB0000-0x0000000003CF2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2156-132-0x0000000003CB0000-0x0000000003CF2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2208-500-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2208-499-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2212-488-0x0000000003C50000-0x0000000003C92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2244-682-0x0000000003C10000-0x0000000003C52000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2252-314-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2252-315-0x0000000003B90000-0x0000000003BD2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2284-660-0x0000000003D10000-0x0000000003D52000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2320-477-0x0000000003F00000-0x0000000003F42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2320-473-0x0000000003F00000-0x0000000003F42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2396-430-0x0000000003A80000-0x0000000003AC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2408-65-0x0000000003CC0000-0x0000000003D02000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2408-66-0x0000000003CC0000-0x0000000003D02000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2460-671-0x0000000004080000-0x00000000040C2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2576-535-0x0000000003B70000-0x0000000003BB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2576-536-0x0000000003B70000-0x0000000003BB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2604-302-0x0000000003C50000-0x0000000003C92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2604-303-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2616-53-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2616-49-0x0000000003B50000-0x0000000003B92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2616-51-0x0000000003B50000-0x0000000003B92000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2620-270-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2620-267-0x0000000003FB0000-0x0000000003FF2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2676-465-0x0000000003F00000-0x0000000003F42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2704-419-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2704-409-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2704-418-0x0000000003F60000-0x0000000003FA2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2760-13-0x0000000003C00000-0x0000000003C42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2760-17-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2760-0-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2768-592-0x0000000003D00000-0x0000000003D42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2768-593-0x0000000003D00000-0x0000000003D42000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2788-256-0x0000000003ED0000-0x0000000003F12000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2800-454-0x0000000004020000-0x0000000004062000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2820-287-0x0000000003AE0000-0x0000000003B22000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2820-293-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2840-626-0x0000000003A70000-0x0000000003AB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2916-247-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2924-149-0x0000000003AD0000-0x0000000003B12000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2924-151-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2952-604-0x0000000003C30000-0x0000000003C72000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2972-637-0x0000000003D70000-0x0000000003DB2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2976-78-0x0000000003AA0000-0x0000000003AE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2976-83-0x0000000003AA0000-0x0000000003AE2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2976-85-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2992-279-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/3000-441-0x00000000040A0000-0x00000000040E2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/3000-442-0x00000000040A0000-0x00000000040E2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/3000-443-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download