Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe
-
Size
1.4MB
-
MD5
8b56e049371d0ad4667839b19abad608
-
SHA1
3b1f8dd9568dd6a905d2b0aa65f6886970649cde
-
SHA256
5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d
-
SHA512
ca59335f0cd508c201011e61a8ae653aec989922afe4c85e403ea77d56608fecc1b7e0727be2c06fed0ad95477aace7d1a3dfc813f8285de0ce1bd6be0b1a191
-
SSDEEP
24576:h+SFQyRru2P6TW+/OMiFhTCRQwG6F5/xsSSBl76xPbdHURIcNTKarBI:NZubTWLb33s/xkl76FZUKaKarB
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CwZLYvboEC\ImagePath = "\\??\\C:\\Windows\\ZuGYQdvth84.sys" 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023ba4-45.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Loads dropped DLL 3 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SaKKXIH\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe File opened for modification C:\Windows\SysWOW64\SaKKXIH\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe -
resource yara_rule behavioral2/files/0x000c000000023ba4-45.dat upx behavioral2/memory/2536-49-0x00000000747D0000-0x0000000074859000-memory.dmp upx behavioral2/memory/2536-70-0x00000000747D0000-0x0000000074859000-memory.dmp upx -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\EGFugJTN\OTUGsHGY.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\14.txt 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\EGFugJTN\VhEgMiVo.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File opened for modification C:\Windows\EGFugJTN\YIjfqhH.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\VqmUkkt.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\EGFugJTN\YIjfqhH.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\EGFugJTN\IoAQIjVM.tmp 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File opened for modification C:\Windows\14.txt 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\ZuGYQdvth84.sys 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\EGFugJTN\EjnBUWWg.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe File created C:\Windows\tmGABQu.dll 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "https://www.hao123.com/?tn=92867579_hao_pg" 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Key deleted \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.hao123.com/?tn=92867579_hao_pg" 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Token: SeLoadDriverPrivilege 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Token: 33 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe Token: SeIncBasePriorityPrivilege 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2536 2512 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe 84 PID 2512 wrote to memory of 2536 2512 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe 84 PID 2512 wrote to memory of 2536 2512 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe 84 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56 PID 2536 wrote to memory of 3516 2536 5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe"C:\Users\Admin\AppData\Local\Temp\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea3680d7d7e2ecf626a9d.exe"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\SaKKXIH\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe"C:\Windows\SysWOW64\SaKKXIH\5a87a704d0e2e7bc2213db0e6298f125c080c468ed8ea380d7d7e2ecf626a9d.exe"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864KB
MD5887a721cfb5a0828a381d0e2f850c90b
SHA1ac099688b7b41cf5762d968fd30c8cb9062312dd
SHA2565170d792808b7a4c517f67788e93ea5891ad17776513fd310b9bd1d7d7968f05
SHA51205a479d22fcaf6cd5fb0e5c07bc835d407ecd34b65e766fe8df4e9cf98fd2368c194c0114f803b1c5e0d790cafde294ba8073a5de7560e492800efe938956f9c
-
Filesize
483KB
MD588c4820aa1ecfa3017963db6a60952a0
SHA195aeaa84e38c62059a703c6a8ce8712df9c990f9
SHA256bb3c682d5bbe59a63dd8fad19466f8c9f770df15acdbed580012be7cea62acbd
SHA512bde8c85f4232f24f415289e1aab61ce090cbd06442d774908a86ede135e74834e4c964c1a584df7a8d37fb56559126de24ff42c8497df7602534cb5d6100f5ee
-
Filesize
1.4MB
MD5686bf654c190b86c125faa6ba3182101
SHA16663a23b08282f61a2d3e6b6516d28c7f13c39cd
SHA256607a446af56bacff69951c83e6b0e19fc243299e4d8cc7823c1e9cc5d718d1ad
SHA512c8c0d07ff48a37d8f606b5d89bb9cf6c55faeeb94ade7a2b7864f598c50ba9ed058ed8897cf36d44e2ef740751e92fadaba435f2a392e3345aec401d1d390f8a