Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/10/2024, 14:22
Behavioral task
behavioral1
Sample
29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe
Resource
win10v2004-20241007-en
General
-
Target
29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe
-
Size
2.9MB
-
MD5
242df407e4154033ba3a19853e56fa50
-
SHA1
cdcd3279ff6ba17a93c063d04d9f06c4e6f031bc
-
SHA256
29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415
-
SHA512
7db027247d834c98e032f066fb0a8351d86553dd9db4510b2bc6bfa8c9d9d18996b07560960c8f26d2ce01764712d09e36d2960a42e1a8f7c2274f9c75031cfe
-
SSDEEP
24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHI:7v97AXmw4gxeOw46fUbNecCCFbNecn
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 7 IoCs
resource yara_rule behavioral1/files/0x000700000001975a-90.dat warzonerat behavioral1/files/0x000600000001960c-169.dat warzonerat behavioral1/files/0x000800000001960c-184.dat warzonerat behavioral1/files/0x000800000001960c-451.dat warzonerat behavioral1/files/0x000800000001960c-491.dat warzonerat behavioral1/files/0x000800000001960c-553.dat warzonerat behavioral1/files/0x000800000001960c-555.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 17 IoCs
pid Process 1488 explorer.exe 1872 explorer.exe 812 explorer.exe 2036 spoolsv.exe 1408 spoolsv.exe 2816 spoolsv.exe 2716 spoolsv.exe 1492 spoolsv.exe 2820 spoolsv.exe 2176 spoolsv.exe 2156 spoolsv.exe 768 spoolsv.exe 932 spoolsv.exe 552 spoolsv.exe 1072 spoolsv.exe 2268 spoolsv.exe 2612 spoolsv.exe -
Loads dropped DLL 23 IoCs
pid Process 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 812 explorer.exe 812 explorer.exe 2036 spoolsv.exe 812 explorer.exe 812 explorer.exe 2816 spoolsv.exe 812 explorer.exe 812 explorer.exe 1492 spoolsv.exe 812 explorer.exe 812 explorer.exe 2176 spoolsv.exe 812 explorer.exe 812 explorer.exe 768 spoolsv.exe 812 explorer.exe 812 explorer.exe 552 spoolsv.exe 812 explorer.exe 812 explorer.exe 2268 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 2772 set thread context of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2940 set thread context of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 set thread context of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 1488 set thread context of 1872 1488 explorer.exe 38 PID 1872 set thread context of 812 1872 explorer.exe 40 PID 1872 set thread context of 1376 1872 explorer.exe 41 PID 2036 set thread context of 1408 2036 spoolsv.exe 45 PID 2816 set thread context of 2716 2816 spoolsv.exe 48 PID 1492 set thread context of 2820 1492 spoolsv.exe 51 PID 2176 set thread context of 2156 2176 spoolsv.exe 54 PID 768 set thread context of 932 768 spoolsv.exe 58 PID 552 set thread context of 1072 552 spoolsv.exe 61 PID 2268 set thread context of 2612 2268 spoolsv.exe 65 -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 1488 explorer.exe 2036 spoolsv.exe 812 explorer.exe 812 explorer.exe 2816 spoolsv.exe 812 explorer.exe 1492 spoolsv.exe 812 explorer.exe 2176 spoolsv.exe 812 explorer.exe 768 spoolsv.exe 812 explorer.exe 552 spoolsv.exe 812 explorer.exe 2268 spoolsv.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 1488 explorer.exe 1488 explorer.exe 812 explorer.exe 812 explorer.exe 2036 spoolsv.exe 2036 spoolsv.exe 812 explorer.exe 812 explorer.exe 2816 spoolsv.exe 2816 spoolsv.exe 1492 spoolsv.exe 1492 spoolsv.exe 2176 spoolsv.exe 2176 spoolsv.exe 768 spoolsv.exe 768 spoolsv.exe 552 spoolsv.exe 552 spoolsv.exe 2268 spoolsv.exe 2268 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2808 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 30 PID 2772 wrote to memory of 2808 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 30 PID 2772 wrote to memory of 2808 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 30 PID 2772 wrote to memory of 2808 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 30 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2772 wrote to memory of 2940 2772 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 32 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2616 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 33 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2940 wrote to memory of 2204 2940 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 34 PID 2616 wrote to memory of 1488 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 35 PID 2616 wrote to memory of 1488 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 35 PID 2616 wrote to memory of 1488 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 35 PID 2616 wrote to memory of 1488 2616 29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe 35 PID 1488 wrote to memory of 3036 1488 explorer.exe 36 PID 1488 wrote to memory of 3036 1488 explorer.exe 36 PID 1488 wrote to memory of 3036 1488 explorer.exe 36 PID 1488 wrote to memory of 3036 1488 explorer.exe 36 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38 PID 1488 wrote to memory of 1872 1488 explorer.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe"C:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exeC:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exeC:\Users\Admin\AppData\Local\Temp\29e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415N.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3036
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:812 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2716
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:3032
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2444
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1392
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:1632
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵PID:2808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵PID:1452
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:1376
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:2204
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5242df407e4154033ba3a19853e56fa50
SHA1cdcd3279ff6ba17a93c063d04d9f06c4e6f031bc
SHA25629e275a4c269803e9a77aa7d35243d335aaabd1f5fd9e71a13adbd5876956415
SHA5127db027247d834c98e032f066fb0a8351d86553dd9db4510b2bc6bfa8c9d9d18996b07560960c8f26d2ce01764712d09e36d2960a42e1a8f7c2274f9c75031cfe
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
2.9MB
MD58f11e00187dec8fa24dc9ef9d524c542
SHA192ee84e55c51ee7e43dd8c59c0d474064ff34269
SHA256b01acee535769d16743e0a8e82e6b7d7083054bc7a8560beeaefdfd9349b5b16
SHA51242c0804258da4306afb722ae1f3d1707108257c319f10f443f9901c8b42566bbff61ce684ff158a57b53547ab6a19bb74b1203b93702ddb891919ca4b4685ab0
-
Filesize
2.1MB
MD5f28d7d476bacab8ed38474493edaf81c
SHA1757450d7cba8900ec0c137f3d96551c1a63c6502
SHA2566eca34228ab686aec9b415bfb3b6ac89929beaae093a266b0e23dfcc4e00a2d4
SHA51214fddd2b771dfc31e622ea8f7ed05adfd068ed54671199747bb8b2d73eb616b212406578ad418b4e5a4c32f31ae1b2980f7a100a8de5488897b1077c1f4b5575
-
Filesize
2.8MB
MD589671c0673cbe8f44191f83293c8ee51
SHA1a6171d9e061899c436d2c30353d1378aaa2c2804
SHA256e6a0f83e964c36212986ea198c4b31712da0f228803466dc985b1cc5ec70c71a
SHA512cfeb97914d7be4da729bfbba48c27fde556b845a61477afec10f8220669de809fed078413c441c93ddb7f2aea52e7f03bfd191d886f070bb747678247764e9dd
-
Filesize
2.9MB
MD53707e1a6a392235fa93acd316801e288
SHA1bce2aaff9972f012be19a1d421661aea31c3ce67
SHA256206459a49878146a58ad23f739259777cf252686ac31e01f15a8d4fff957a5ba
SHA512ab328564c3b24f2336199458657490ab8f6165f3e45b2c7f6ccf14395437b9c4a99bb5786d5b1c209125db7d46ea2f7008984fe04097e92e02ff452e585222ad
-
Filesize
2.2MB
MD5fdbc0ad8110141913944e92afe93de9e
SHA1194aab30fcd1883c7358a3247ba8839517406cfd
SHA2565eedf26a9d0e66e2cf4a37b962aaf59eaee1bd5cd9a9c0fe588c509a1b769ba3
SHA512f3e92d14aed995de6f6cee449453cd22bb37daa1a1271e92037bb126cd6fa409a0d0d79e1ee41753fceb5f509460196705f16e0012bc8d46c9149eaabc14c6b1
-
Filesize
1.2MB
MD5e4c804fcfec47644f4bc99af08b7882c
SHA14673ed421272f35799fcbfcdcb2f2be1e0c3c27a
SHA256480ec97aa6072fe91f42268c03308577c3f9b0691b644be882a7e2dd102b694a
SHA5128a385cbfff4f5ea5903b68582a585ec710fc5a6c9e19abb0cc39fdce1367680f9e3c17db59d7fe03fcc4697f8432cee7d4d59ee82a2ac504d2b748ac33328031
-
Filesize
2.5MB
MD580aa794778d7f9e5fa1a00776ea37af2
SHA1e8636f8a3efab848cbb35841c2f1e2b986453995
SHA2569084f3a78117b25f27b6fcdd1c08d6ff12f5f003786c878b2184ba0081b437e9
SHA512e2871fbc1f9f28b2af1486a998b4d6a2810959b23093399296c24452c0d47b4d63f4b4c04b632f3f6c8e580a1b9b3c720d534029c2117bff6f6b5bafae1c1a47
-
Filesize
832KB
MD5f29b1dbb7efbc9b9463b9f2bdeb95cce
SHA10f1707087dfcc0d0208815a2f6f9aaa8d0fd963b
SHA256fa356ddc95a38901fcc2940d55530a0ebb45ba56c395ab41d39da4ce62cc8030
SHA512a41f53b2f4224595f8a70e9c2cea7566ea99c4229ca61d1e940e00d0599de64fc1d1ba76b4317979bd2a13cc999b024ed4cf2b89458b69f79ac9245938c64e4a