Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
3b8558d14b8bec08fe9f9ef78c1fb7c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b8558d14b8bec08fe9f9ef78c1fb7c6.exe
Resource
win10v2004-20240802-en
General
-
Target
3b8558d14b8bec08fe9f9ef78c1fb7c6.exe
-
Size
8.7MB
-
MD5
3b8558d14b8bec08fe9f9ef78c1fb7c6
-
SHA1
d8cfe796e8a12b1c46598fe3daee9eb65a3aac0d
-
SHA256
de7741a1b4e38e18f595621651df024e56db034c692190b5b6115d2b4b1033cb
-
SHA512
d388d818a770a081b4d2cddfcc66a32f04357afa3905d63929fed9c77d723572436ab2d3efe2f2d3e4fcebb35fce5fd93100f9b31695fbeb5a28c6e49268941c
-
SSDEEP
24576:XaVPwvlamIBIEurOuSmKAFdrQLY9MyUT/iMWSFHJNzjyfJV5v7KInxhygjsSL:XiPeAVIbSmKAFaWbUTRrzeft+Ixhrj
Malware Config
Signatures
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3104 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1544 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4896 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3324 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4344 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 4576 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2528 4576 schtasks.exe 82 -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation explorer.exe -
Executes dropped EXE 16 IoCs
pid Process 1048 explorer.exe 1468 explorer.exe 1956 explorer.exe 2172 explorer.exe 1488 explorer.exe 3988 explorer.exe 1848 explorer.exe 4800 explorer.exe 2776 explorer.exe 396 explorer.exe 3876 explorer.exe 1252 explorer.exe 4816 explorer.exe 4044 explorer.exe 2280 explorer.exe 5040 explorer.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\121e5b5079f7c0 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe File created C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe File created C:\Program Files\Mozilla Firefox\fonts\f3b6ecef712a24 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe File created C:\Program Files\Reference Assemblies\explorer.exe 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe File created C:\Program Files\Reference Assemblies\7a0fd90576e088 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3736 PING.EXE 3828 PING.EXE 1744 PING.EXE 3668 PING.EXE 2120 PING.EXE -
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings explorer.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 2120 PING.EXE 3736 PING.EXE 3828 PING.EXE 1744 PING.EXE 3668 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1544 schtasks.exe 1936 schtasks.exe 5008 schtasks.exe 3104 schtasks.exe 3324 schtasks.exe 4344 schtasks.exe 2528 schtasks.exe 2356 schtasks.exe 2676 schtasks.exe 1488 schtasks.exe 4868 schtasks.exe 2268 schtasks.exe 2764 schtasks.exe 4788 schtasks.exe 4896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe 1048 explorer.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe Token: SeDebugPrivilege 1048 explorer.exe Token: SeDebugPrivilege 1468 explorer.exe Token: SeDebugPrivilege 1956 explorer.exe Token: SeDebugPrivilege 2172 explorer.exe Token: SeDebugPrivilege 1488 explorer.exe Token: SeDebugPrivilege 3988 explorer.exe Token: SeDebugPrivilege 1848 explorer.exe Token: SeDebugPrivilege 4800 explorer.exe Token: SeDebugPrivilege 2776 explorer.exe Token: SeDebugPrivilege 396 explorer.exe Token: SeDebugPrivilege 3876 explorer.exe Token: SeDebugPrivilege 1252 explorer.exe Token: SeDebugPrivilege 4816 explorer.exe Token: SeDebugPrivilege 4044 explorer.exe Token: SeDebugPrivilege 2280 explorer.exe Token: SeDebugPrivilege 5040 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 112 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 98 PID 3504 wrote to memory of 112 3504 3b8558d14b8bec08fe9f9ef78c1fb7c6.exe 98 PID 112 wrote to memory of 3124 112 cmd.exe 100 PID 112 wrote to memory of 3124 112 cmd.exe 100 PID 112 wrote to memory of 4876 112 cmd.exe 101 PID 112 wrote to memory of 4876 112 cmd.exe 101 PID 112 wrote to memory of 1048 112 cmd.exe 104 PID 112 wrote to memory of 1048 112 cmd.exe 104 PID 1048 wrote to memory of 680 1048 explorer.exe 106 PID 1048 wrote to memory of 680 1048 explorer.exe 106 PID 680 wrote to memory of 944 680 cmd.exe 108 PID 680 wrote to memory of 944 680 cmd.exe 108 PID 680 wrote to memory of 4212 680 cmd.exe 109 PID 680 wrote to memory of 4212 680 cmd.exe 109 PID 680 wrote to memory of 1468 680 cmd.exe 113 PID 680 wrote to memory of 1468 680 cmd.exe 113 PID 1468 wrote to memory of 5004 1468 explorer.exe 114 PID 1468 wrote to memory of 5004 1468 explorer.exe 114 PID 5004 wrote to memory of 636 5004 cmd.exe 116 PID 5004 wrote to memory of 636 5004 cmd.exe 116 PID 5004 wrote to memory of 1744 5004 cmd.exe 117 PID 5004 wrote to memory of 1744 5004 cmd.exe 117 PID 5004 wrote to memory of 1956 5004 cmd.exe 118 PID 5004 wrote to memory of 1956 5004 cmd.exe 118 PID 1956 wrote to memory of 2240 1956 explorer.exe 120 PID 1956 wrote to memory of 2240 1956 explorer.exe 120 PID 2240 wrote to memory of 780 2240 cmd.exe 122 PID 2240 wrote to memory of 780 2240 cmd.exe 122 PID 2240 wrote to memory of 1368 2240 cmd.exe 123 PID 2240 wrote to memory of 1368 2240 cmd.exe 123 PID 2240 wrote to memory of 2172 2240 cmd.exe 124 PID 2240 wrote to memory of 2172 2240 cmd.exe 124 PID 2172 wrote to memory of 3356 2172 explorer.exe 126 PID 2172 wrote to memory of 3356 2172 explorer.exe 126 PID 3356 wrote to memory of 1544 3356 cmd.exe 128 PID 3356 wrote to memory of 1544 3356 cmd.exe 128 PID 3356 wrote to memory of 4896 3356 cmd.exe 129 PID 3356 wrote to memory of 4896 3356 cmd.exe 129 PID 3356 wrote to memory of 1488 3356 cmd.exe 130 PID 3356 wrote to memory of 1488 3356 cmd.exe 130 PID 1488 wrote to memory of 3916 1488 explorer.exe 131 PID 1488 wrote to memory of 3916 1488 explorer.exe 131 PID 3916 wrote to memory of 1400 3916 cmd.exe 133 PID 3916 wrote to memory of 1400 3916 cmd.exe 133 PID 3916 wrote to memory of 4976 3916 cmd.exe 134 PID 3916 wrote to memory of 4976 3916 cmd.exe 134 PID 3916 wrote to memory of 3988 3916 cmd.exe 135 PID 3916 wrote to memory of 3988 3916 cmd.exe 135 PID 3988 wrote to memory of 3720 3988 explorer.exe 136 PID 3988 wrote to memory of 3720 3988 explorer.exe 136 PID 3720 wrote to memory of 4960 3720 cmd.exe 138 PID 3720 wrote to memory of 4960 3720 cmd.exe 138 PID 3720 wrote to memory of 4632 3720 cmd.exe 139 PID 3720 wrote to memory of 4632 3720 cmd.exe 139 PID 3720 wrote to memory of 1848 3720 cmd.exe 140 PID 3720 wrote to memory of 1848 3720 cmd.exe 140 PID 1848 wrote to memory of 4732 1848 explorer.exe 141 PID 1848 wrote to memory of 4732 1848 explorer.exe 141 PID 4732 wrote to memory of 3524 4732 cmd.exe 143 PID 4732 wrote to memory of 3524 4732 cmd.exe 143 PID 4732 wrote to memory of 4992 4732 cmd.exe 144 PID 4732 wrote to memory of 4992 4732 cmd.exe 144 PID 4732 wrote to memory of 4800 4732 cmd.exe 145 PID 4732 wrote to memory of 4800 4732 cmd.exe 145 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8558d14b8bec08fe9f9ef78c1fb7c6.exe"C:\Users\Admin\AppData\Local\Temp\3b8558d14b8bec08fe9f9ef78c1fb7c6.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kr9GNC90df.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3124
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:4876
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z0hIbOJQ8t.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:944
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:25⤵PID:4212
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\581siQe8es.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\system32\chcp.comchcp 650017⤵PID:636
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1744
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rln2uypvqA.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\chcp.comchcp 650019⤵PID:780
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:1368
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QgWt8DckRd.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\system32\chcp.comchcp 6500111⤵PID:1544
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4896
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E7ZnFR4Wgx.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\system32\chcp.comchcp 6500113⤵PID:1400
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4976
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Nq0CBezpn.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\system32\chcp.comchcp 6500115⤵PID:4960
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4632
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rln2uypvqA.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\chcp.comchcp 6500117⤵PID:3524
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4992
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4800 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QgWt8DckRd.bat"18⤵PID:4360
-
C:\Windows\system32\chcp.comchcp 6500119⤵PID:1760
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1084
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m961u58njg.bat"20⤵PID:4448
-
C:\Windows\system32\chcp.comchcp 6500121⤵PID:4756
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost21⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3668
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:396 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ex1oYQHqtZ.bat"22⤵PID:4316
-
C:\Windows\system32\chcp.comchcp 6500123⤵PID:2904
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3984
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3876 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat"24⤵PID:208
-
C:\Windows\system32\chcp.comchcp 6500125⤵PID:3064
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4468
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\diBg3fIzhe.bat"26⤵PID:4868
-
C:\Windows\system32\chcp.comchcp 6500127⤵PID:3048
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost27⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2120
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4816 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vTHQNFoTQv.bat"28⤵PID:1532
-
C:\Windows\system32\chcp.comchcp 6500129⤵PID:2912
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost29⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3736
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4044 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L4pr7KvdK9.bat"30⤵PID:1516
-
C:\Windows\system32\chcp.comchcp 6500131⤵PID:700
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4720
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\szcAPjpm25.bat"32⤵PID:1084
-
C:\Windows\system32\chcp.comchcp 6500133⤵PID:3764
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3828
-
-
C:\Recovery\WindowsRE\explorer.exe"C:\Recovery\WindowsRE\explorer.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HaE3Dx3E3n.bat"34⤵PID:760
-
C:\Windows\system32\chcp.comchcp 6500135⤵PID:3232
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:235⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.7MB
MD53b8558d14b8bec08fe9f9ef78c1fb7c6
SHA1d8cfe796e8a12b1c46598fe3daee9eb65a3aac0d
SHA256de7741a1b4e38e18f595621651df024e56db034c692190b5b6115d2b4b1033cb
SHA512d388d818a770a081b4d2cddfcc66a32f04357afa3905d63929fed9c77d723572436ab2d3efe2f2d3e4fcebb35fce5fd93100f9b31695fbeb5a28c6e49268941c
-
Filesize
1KB
MD5a24106fd92046ea9069a397ceb413237
SHA1af763d3cdbcba493b8d4a1d67abd5d749933e26a
SHA256c6893fabaf71b5e28c2ecf4c4d82043b0e331bef9af0170fed89f3f70fed169b
SHA512334e89b77ddae354f8730ee7fa258b29025331a31f9bfa6ba5d61be08f2b62fd1c829c9e7ec45cd14665f4f2a94ddd13f70a782952b8e07def0cfc832fac7d00
-
Filesize
210B
MD5e9000967e96a6bb624331cdcddb3b5cc
SHA1296fa0b091c79750e049be204f97d2d68ddab9ed
SHA25633b7e3bafaa592e70be4f4664c30eeba07df08085d9f513ef2eee2740554c1cb
SHA512a6fe596fcc1d4625b6c0ca1c602bca05afb8a6deb90b57de9f38f4e283f8a60d49518708758b2111f774ead25d5ee92e08d555bdf5dce20bb4b9f71d862fb04a
-
Filesize
162B
MD5c733d39a5c3c0216310e930460657a9b
SHA139304623f5ff67b36582b1639e021900669447f1
SHA2568674fec6a6f079ecc1eac0ee07b25cebd15df5311f02802452f4957e88e24ee2
SHA5124b27a8b125be30f8caa235324ae0b727cc14aca2d2c09779a783d58856a384f9bcc99cfdba1da326cb37d4c7086519f03ecc027c8ed12cfd726ebbe1dfd905a4
-
Filesize
210B
MD5617b6306ec318bc39b46fc36bd84f196
SHA1fc127d26cb0502adbc8123a7c6fcfd817d651e8a
SHA256572d3ef4e3f46ccc2f72299efe165d511270b3cb5b424ca1c0329f2ef4d4f534
SHA512a17b787120f4b93b009b0359ea6c222a127bd23028f0ff0400f98984c3d5c1a4ad39656960b7923e5cf2a9105c7529756ee249177262e3a00c0b1cfc9cfc4b02
-
Filesize
210B
MD5962b62a5e3e7236e607f29633e966f7d
SHA1aafa8224c4aa8e93c7eea0ceee18e369b58078b2
SHA256dada731a3e79bb2e089c659d27c32ceb71a0bfeacfe2ed2afd53dd32981b037a
SHA51272bd6845094dd63610e5b91cee91a802d994843d9cdd1077bf2bc4fdbb2585a7514d970ae0e6aba3262d975f01c4d1a36d8a3026959d7eeb362ced9521f49874
-
Filesize
210B
MD583250a64067d849a94bb295d125d2bee
SHA1566281817446a5d8a1a67000d0f0f83c048fefaa
SHA2567112cb4a209ef006f6ef813ca4bf0a0ea4e2a05420f6e8789d967577b044c2af
SHA512f110d4fb50edb04fde4d8a586b98b8b6a149c63bbd4545634377d7fddefb7164896d4b421c4081111b7d31784d52436166c39829a5f4161667910dfa6b99a5be
-
Filesize
210B
MD5b24ccd50645adaf203cb1731d76bedbb
SHA1bead23ad71b3327c57b9945426fa3f424c5121f4
SHA256680bef64f82987cea188be1fb63109a88b9d1badf31be0aaed4dcb93a22b8115
SHA5121f65b121a2fb1c5245c367a0715e8a65b5e8c711118df61a06b3f5520371a2f1b4b9b479db8b3cacce4602be83a2a8ee1057dfea14cc774d9e0d2bdcc744758a
-
Filesize
210B
MD5a0098c85bb6dc02a58b824c9b12e8cab
SHA1934125050a832d5498670611e63fc255e869e794
SHA2561f17e675eb552f7d1610e8d32e8f3b5564e8a43027dcd87b9e76d4d5afaeb613
SHA512f74d5495f777c269c257303efd7f846bf3cd483ff2036ea8536798afba8033baf6af0241d61b37969a63d535da2060b93557ac9bc9ce97a9d1c69e4498a4b0a8
-
Filesize
210B
MD507adfc61f349da0ebd9c4c5efca2f33b
SHA1cf791d14a7a7db7c60c2e1680ed70f806e2b8827
SHA256a9d40d70aecc7dce2e0df58674f7fc52cf179a7f513b72ec247afaabdf3cad61
SHA512a56504906643d8a24cd2624c271191b023116edbdad63269dda6b1156a1c3e4345528435fc0aa8e57c0e1b61b286167c465ca59a16848af871d127fb9e2f659c
-
Filesize
210B
MD5cb8edd48edaab26915dc0ad070457686
SHA1d2e393e809aa340c253a35119577ac537e6e2f6a
SHA256953a27e4782b952859f723554881ed607bbce9cad7fd8e8132a267394764db25
SHA5127252468f199818e7c0f6c5273e67f642183ce58d089f9562b502ae50637992311fe85c545642dcf8ae25d1a0c7de724a55bc575a7e2d03f8e2217905a5f25ddf
-
Filesize
162B
MD54e941b5b7bc45677b11f886714c8448d
SHA18a52686b305cd9db7d5d24087d7de2dcf7fe3092
SHA2560911befadb2e5a81d371eb32a5eb17e5c33c1a8951cdb874764b180877d623ec
SHA51216f0718df52eb2f330baee646141fdd26ef43df09b10b4ce2678348fa3e2b7c7c3186e7272ba2133548bf635047fda0fc61963e19ce07a02dd3c278a32939055
-
Filesize
210B
MD583b08f9d07b8dd90c2e1cb79ff746849
SHA1e217128831e5e102285ad77af9de9ce5fe846161
SHA2561098e1bcb8f4c2943b40e4a2ff79801b300259728b641e08d361492450acc5c6
SHA512202a42b111148f344faae2eaf99b828c4a6e36d223d46bdbb239de50d938301d99bf436238dc8db8a279ae9d0746d60ce2fae9172c983926551a6edb25a5764b
-
Filesize
162B
MD5ea770b6f908bd579e0f34b49b930746e
SHA11461d2489e03c937711be634e1099412aa2f2c14
SHA2565fc3f43bd1a6a9e2894b0a0b7c5ffd1eeb3339c16911b5b104c4388bf2d1a2f3
SHA51281b4402defe199d6c9eac0b3d044c75d24de7be88d295061d4fa3e7e5bea41364618fec98cf682ce6566d4ad352d9394e75384be41791119dc167fd3f3ac52fe
-
Filesize
210B
MD5fbadd1e3d2943c2c1e0f299537874fcd
SHA1805cf4f497c9f30dc719c1f447ba0c467b594b62
SHA256c2d0e1912eb2cdcd6cc5e3a9194b8e927ec0aa218a70ac6eb04d912de8bdfb46
SHA5123604347f2465da28053076da569202d8f85d4912932adbe7ec4a8afae260d0cb55a68aebc6bd96625a2203f0a265ca4cc05311c41826bd302c66d0661a064f59
-
Filesize
162B
MD5f5bb2bca39e242c09ef71955a70dbb0e
SHA1cc54789cf44cb0ff4bdaa925af609349e9f91a90
SHA256dd28aad70193be32f8cf9695f7c70eccfd94cd7d10d8d5b1ae1f80f27c9cc102
SHA512a1d9a34d06e4d1809000d7fdc40f5b1f16ced9dcc4917708299211179fa803a5f2e868baa0dcb9c7d8d628bd838e1f63e094a461fb302d84ad2fb1a7776391f7
-
Filesize
162B
MD5bcbeef8b30742ef0d1e8351ab9b5a43e
SHA14de30e779395f8ee94bcc590b0bc85a24549eb9b
SHA256d978d687e612a625fca7d8a78c1e76237a6ec2e2639fd858de7858fe32a15fd8
SHA51270079c33ae7395f2408a6538a44a796c5aad049f48bc0be1bcadadee28e3f869e68dbb4e52bc3a73e83f40176707bbd3938c47228cc0b7f898478a13f0a08398