Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 23:33
Behavioral task
behavioral1
Sample
3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe
Resource
win10v2004-20240802-en
General
-
Target
3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe
-
Size
19KB
-
MD5
6103b71e8c01efb84c8673a6a83a6f20
-
SHA1
bcf90b4b43c65198aa605e9bc9246658524e851e
-
SHA256
3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491
-
SHA512
384a2af86b12398f7d27cf2f312f106df0bc1d510d313774337b7d75ce311629f2a12aac90ae43c9184950558176ef0658f00543067b8988bab86ecefac088f6
-
SSDEEP
384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5x5+gY7lAt7BDf8:g5BOFKksO1mE9B77777J77c77c77c71S
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2774E5.exe\"" 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2774E5.exe\"" 2774E5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2774E5.exe\"" 2774E5STTUQS.exe -
Executes dropped EXE 5 IoCs
pid Process 2212 2774E5.exe 1064 2774E5STTUQS.exe 4172 2774E5STTUQS.exe 1284 2774E5.exe 1772 2774E5.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2774E5.exe = "C:\\Windows\\2774E5.exe" 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2774E5.exe = "C:\\Windows\\2774E5.exe" 2774E5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2774E5.exe = "C:\\Windows\\2774E5.exe" 2774E5STTUQS.exe -
resource yara_rule behavioral2/memory/4508-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000800000002346a-7.dat upx behavioral2/files/0x000700000002346e-13.dat upx behavioral2/memory/4172-22-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1284-27-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1772-33-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4508-35-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-36-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-37-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-38-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-39-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-40-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-41-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-42-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-43-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-45-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-44-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-47-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-46-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-48-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-49-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-51-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-50-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-52-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-53-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-55-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-54-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-56-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-57-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2212-58-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1064-59-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2774E5.exe 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe File opened for modification C:\Windows\2774E5STTUQS.exe 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe -
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774E5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774E5STTUQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774E5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774E5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774E5STTUQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe -
Kills process with taskkill 42 IoCs
pid Process 4616 TASKKILL.exe 1840 TASKKILL.exe 972 TASKKILL.exe 3088 TASKKILL.exe 2236 TASKKILL.exe 3776 TASKKILL.exe 3292 TASKKILL.exe 4692 TASKKILL.exe 2148 TASKKILL.exe 1308 TASKKILL.exe 4808 TASKKILL.exe 1148 TASKKILL.exe 2372 TASKKILL.exe 872 TASKKILL.exe 2172 TASKKILL.exe 4032 TASKKILL.exe 1448 TASKKILL.exe 788 TASKKILL.exe 1860 TASKKILL.exe 4444 TASKKILL.exe 2896 TASKKILL.exe 4600 TASKKILL.exe 4316 TASKKILL.exe 5048 TASKKILL.exe 1456 TASKKILL.exe 2912 TASKKILL.exe 3664 TASKKILL.exe 4224 TASKKILL.exe 612 TASKKILL.exe 1620 TASKKILL.exe 888 TASKKILL.exe 1992 TASKKILL.exe 4996 TASKKILL.exe 4220 TASKKILL.exe 1868 TASKKILL.exe 2644 TASKKILL.exe 4836 TASKKILL.exe 3180 TASKKILL.exe 4792 TASKKILL.exe 868 TASKKILL.exe 2708 TASKKILL.exe 2120 TASKKILL.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 3292 TASKKILL.exe Token: SeDebugPrivilege 612 TASKKILL.exe Token: SeDebugPrivilege 5048 TASKKILL.exe Token: SeDebugPrivilege 4600 TASKKILL.exe Token: SeDebugPrivilege 1840 TASKKILL.exe Token: SeDebugPrivilege 3664 TASKKILL.exe Token: SeDebugPrivilege 972 TASKKILL.exe Token: SeDebugPrivilege 4316 TASKKILL.exe Token: SeDebugPrivilege 788 TASKKILL.exe Token: SeDebugPrivilege 1620 TASKKILL.exe Token: SeDebugPrivilege 2172 TASKKILL.exe Token: SeDebugPrivilege 1148 TASKKILL.exe Token: SeDebugPrivilege 2644 TASKKILL.exe Token: SeDebugPrivilege 2708 TASKKILL.exe Token: SeDebugPrivilege 1456 TASKKILL.exe Token: SeDebugPrivilege 4220 TASKKILL.exe Token: SeDebugPrivilege 4692 TASKKILL.exe Token: SeDebugPrivilege 1868 TASKKILL.exe Token: SeDebugPrivilege 3180 TASKKILL.exe Token: SeDebugPrivilege 4792 TASKKILL.exe Token: SeDebugPrivilege 4996 TASKKILL.exe Token: SeDebugPrivilege 1860 TASKKILL.exe Token: SeDebugPrivilege 4616 TASKKILL.exe Token: SeDebugPrivilege 2372 TASKKILL.exe Token: SeDebugPrivilege 2148 TASKKILL.exe Token: SeDebugPrivilege 4444 TASKKILL.exe Token: SeDebugPrivilege 4836 TASKKILL.exe Token: SeDebugPrivilege 4224 TASKKILL.exe Token: SeDebugPrivilege 1992 TASKKILL.exe Token: SeDebugPrivilege 872 TASKKILL.exe Token: SeDebugPrivilege 1448 TASKKILL.exe Token: SeDebugPrivilege 3088 TASKKILL.exe Token: SeDebugPrivilege 888 TASKKILL.exe Token: SeDebugPrivilege 4032 TASKKILL.exe Token: SeDebugPrivilege 868 TASKKILL.exe Token: SeDebugPrivilege 2236 TASKKILL.exe Token: SeDebugPrivilege 2912 TASKKILL.exe Token: SeDebugPrivilege 1308 TASKKILL.exe Token: SeDebugPrivilege 4808 TASKKILL.exe Token: SeDebugPrivilege 3776 TASKKILL.exe Token: SeDebugPrivilege 2896 TASKKILL.exe Token: SeDebugPrivilege 2120 TASKKILL.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 2212 2774E5.exe 1064 2774E5STTUQS.exe 4172 2774E5STTUQS.exe 1284 2774E5.exe 1772 2774E5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 788 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 82 PID 4508 wrote to memory of 788 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 82 PID 4508 wrote to memory of 788 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 82 PID 4508 wrote to memory of 2172 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 83 PID 4508 wrote to memory of 2172 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 83 PID 4508 wrote to memory of 2172 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 83 PID 4508 wrote to memory of 4316 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 84 PID 4508 wrote to memory of 4316 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 84 PID 4508 wrote to memory of 4316 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 84 PID 4508 wrote to memory of 972 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 85 PID 4508 wrote to memory of 972 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 85 PID 4508 wrote to memory of 972 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 85 PID 4508 wrote to memory of 1456 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 86 PID 4508 wrote to memory of 1456 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 86 PID 4508 wrote to memory of 1456 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 86 PID 4508 wrote to memory of 2644 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 87 PID 4508 wrote to memory of 2644 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 87 PID 4508 wrote to memory of 2644 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 87 PID 4508 wrote to memory of 4600 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 88 PID 4508 wrote to memory of 4600 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 88 PID 4508 wrote to memory of 4600 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 88 PID 4508 wrote to memory of 5048 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 89 PID 4508 wrote to memory of 5048 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 89 PID 4508 wrote to memory of 5048 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 89 PID 4508 wrote to memory of 1620 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 90 PID 4508 wrote to memory of 1620 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 90 PID 4508 wrote to memory of 1620 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 90 PID 4508 wrote to memory of 612 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 91 PID 4508 wrote to memory of 612 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 91 PID 4508 wrote to memory of 612 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 91 PID 4508 wrote to memory of 1840 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 92 PID 4508 wrote to memory of 1840 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 92 PID 4508 wrote to memory of 1840 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 92 PID 4508 wrote to memory of 3664 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 93 PID 4508 wrote to memory of 3664 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 93 PID 4508 wrote to memory of 3664 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 93 PID 4508 wrote to memory of 1148 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 94 PID 4508 wrote to memory of 1148 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 94 PID 4508 wrote to memory of 1148 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 94 PID 4508 wrote to memory of 3292 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 95 PID 4508 wrote to memory of 3292 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 95 PID 4508 wrote to memory of 3292 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 95 PID 4508 wrote to memory of 2212 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 110 PID 4508 wrote to memory of 2212 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 110 PID 4508 wrote to memory of 2212 4508 3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe 110 PID 2212 wrote to memory of 1868 2212 2774E5.exe 111 PID 2212 wrote to memory of 1868 2212 2774E5.exe 111 PID 2212 wrote to memory of 1868 2212 2774E5.exe 111 PID 2212 wrote to memory of 4220 2212 2774E5.exe 112 PID 2212 wrote to memory of 4220 2212 2774E5.exe 112 PID 2212 wrote to memory of 4220 2212 2774E5.exe 112 PID 2212 wrote to memory of 4792 2212 2774E5.exe 113 PID 2212 wrote to memory of 4792 2212 2774E5.exe 113 PID 2212 wrote to memory of 4792 2212 2774E5.exe 113 PID 2212 wrote to memory of 2148 2212 2774E5.exe 114 PID 2212 wrote to memory of 2148 2212 2774E5.exe 114 PID 2212 wrote to memory of 2148 2212 2774E5.exe 114 PID 2212 wrote to memory of 4996 2212 2774E5.exe 115 PID 2212 wrote to memory of 4996 2212 2774E5.exe 115 PID 2212 wrote to memory of 4996 2212 2774E5.exe 115 PID 2212 wrote to memory of 1992 2212 2774E5.exe 116 PID 2212 wrote to memory of 1992 2212 2774E5.exe 116 PID 2212 wrote to memory of 1992 2212 2774E5.exe 116 PID 2212 wrote to memory of 2708 2212 2774E5.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe"C:\Users\Admin\AppData\Local\Temp\3a1024cabe4458b882d722ca9563f7b0551280d0a264bcfc4947f888d4f66491N.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:788
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
C:\Windows\2774E5.exeC:\Windows\2774E5.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Windows\2774E5STTUQS.exeC:\Windows\2774E5STTUQS.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\2774E5STTUQS.exeC:\Windows\2774E5STTUQS.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4172
-
-
C:\Windows\2774E5.exeC:\Windows\2774E5.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
-
C:\Windows\2774E5.exeC:\Windows\2774E5.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD559c28beffe75d5ebf92d16bccd998dce
SHA137df342c00b4512196a7a5f360a0dfddee0be8d9
SHA2561a85d766b69916732874647f546f68f1f91bca70b2b3bf15677b0f15dbab19aa
SHA512a018bbec695477ec908bd4786eb477ed561631dfe6f3b22b75a50e2c44bd6e2299d543cec7aea609f5d83f5783d9aba16b5d547f4daa0c779dc94fe09877b987
-
Filesize
21KB
MD519ac4326320a8fb89eba3d2d6582efe0
SHA1957cac537a49f4ec4183f7440d79409ba4603f35
SHA25666dce0f1f2f992fd405dd784b30a339e831e66c9f23e088b6c9f39c7d1e53001
SHA512ec785fd9141b05799d08a5cbd069d747529cc172c624f19004c29072cdaf478787b166bff6cf43294501d7457bd7c14dec03b33fe30510cc860f6e4331804a1f