Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/10/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe
Resource
win7-20240903-en
General
-
Target
998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe
-
Size
349KB
-
MD5
fd207d1bab69d0023f82899d97ef7dbc
-
SHA1
17dd005869998d981fbaf38d29d8c3d84fd7d060
-
SHA256
998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c
-
SHA512
ccbead30a9720f29f66ee46d91bab36fd512d51ae991d2e7c546391ff4cdd6764aa47d1b866e1887f5dbf52606f892fb62a891af048b59dc3ed6c15d11ecfc23
-
SSDEEP
6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIz:FB1Q6rpr7MrswfLjGwW5xFdRyJpy
Malware Config
Extracted
nanocore
1.2.2.2
bemery2.no-ip.biz:57628
127.0.0.1:57628
997af15f-5576-4030-975c-eb3264fb6789
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-04-23T21:31:33.540664436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
57628
-
default_group
grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+09
-
mutex
997af15f-5576-4030-975c-eb3264fb6789
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
bemery2.no-ip.biz
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2216 attrib.exe -
Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Subsystem = "C:\\Program Files (x86)\\DPI Subsystem\\dpiss.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1704 set thread context of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DPI Subsystem\dpiss.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1260 ping.exe 588 ping.exe 2192 ping.exe 1508 ping.exe 704 ping.exe 2376 ping.exe 2792 ping.exe 2680 ping.exe 2956 ping.exe 1732 ping.exe 1780 ping.exe 880 ping.exe 2444 ping.exe 2340 ping.exe 2780 ping.exe 2232 ping.exe 1140 ping.exe 900 ping.exe 2196 ping.exe 2064 ping.exe -
Runs ping.exe 1 TTPs 20 IoCs
pid Process 1732 ping.exe 588 ping.exe 704 ping.exe 2444 ping.exe 2340 ping.exe 1140 ping.exe 2192 ping.exe 1508 ping.exe 1780 ping.exe 2780 ping.exe 1260 ping.exe 900 ping.exe 2956 ping.exe 2376 ping.exe 880 ping.exe 2792 ping.exe 2680 ping.exe 2232 ping.exe 2196 ping.exe 2064 ping.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2496 RegAsm.exe 2496 RegAsm.exe 2496 RegAsm.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2496 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe Token: SeDebugPrivilege 2496 RegAsm.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 DllHost.exe 2552 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2340 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 31 PID 1704 wrote to memory of 2340 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 31 PID 1704 wrote to memory of 2340 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 31 PID 1704 wrote to memory of 2340 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 31 PID 1704 wrote to memory of 2780 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 34 PID 1704 wrote to memory of 2780 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 34 PID 1704 wrote to memory of 2780 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 34 PID 1704 wrote to memory of 2780 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 34 PID 1704 wrote to memory of 2792 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 36 PID 1704 wrote to memory of 2792 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 36 PID 1704 wrote to memory of 2792 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 36 PID 1704 wrote to memory of 2792 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 36 PID 1704 wrote to memory of 2680 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 38 PID 1704 wrote to memory of 2680 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 38 PID 1704 wrote to memory of 2680 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 38 PID 1704 wrote to memory of 2680 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 38 PID 1704 wrote to memory of 2232 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 40 PID 1704 wrote to memory of 2232 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 40 PID 1704 wrote to memory of 2232 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 40 PID 1704 wrote to memory of 2232 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 40 PID 1704 wrote to memory of 1140 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 42 PID 1704 wrote to memory of 1140 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 42 PID 1704 wrote to memory of 1140 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 42 PID 1704 wrote to memory of 1140 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 42 PID 1704 wrote to memory of 1260 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 44 PID 1704 wrote to memory of 1260 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 44 PID 1704 wrote to memory of 1260 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 44 PID 1704 wrote to memory of 1260 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 44 PID 1704 wrote to memory of 900 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 46 PID 1704 wrote to memory of 900 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 46 PID 1704 wrote to memory of 900 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 46 PID 1704 wrote to memory of 900 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 46 PID 1704 wrote to memory of 2956 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 48 PID 1704 wrote to memory of 2956 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 48 PID 1704 wrote to memory of 2956 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 48 PID 1704 wrote to memory of 2956 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 48 PID 1704 wrote to memory of 1732 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 50 PID 1704 wrote to memory of 1732 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 50 PID 1704 wrote to memory of 1732 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 50 PID 1704 wrote to memory of 1732 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 50 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2496 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 52 PID 1704 wrote to memory of 2216 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 53 PID 1704 wrote to memory of 2216 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 53 PID 1704 wrote to memory of 2216 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 53 PID 1704 wrote to memory of 2216 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 53 PID 1704 wrote to memory of 588 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 55 PID 1704 wrote to memory of 588 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 55 PID 1704 wrote to memory of 588 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 55 PID 1704 wrote to memory of 588 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 55 PID 1704 wrote to memory of 2192 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 57 PID 1704 wrote to memory of 2192 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 57 PID 1704 wrote to memory of 2192 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 57 PID 1704 wrote to memory of 2192 1704 998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe 57 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2216 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe"C:\Users\Admin\AppData\Local\Temp\998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2340
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2780
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2792
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2680
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2232
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1140
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1260
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:900
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2956
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1732
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\998de89ee03ee93b66eb6cb6920ee72fb8e9598ee3bd025af7c810b21273732c.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2216
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:588
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2192
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1508
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:704
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2376
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1780
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:880
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2444
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2196
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2064
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1588
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1220
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3056
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1960
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2260
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:628
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1604
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:608
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:324
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2552
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD585aa412748cec606260dfc07a2ba0493
SHA1b1604d7f6a3bea2c716137e93c1b3206e4581595
SHA256603e434580ef4df688fa85fa8b0bd552fcc06fa7882c1d2789c8c52bce87752f
SHA51298ffc0676b705619d6fb206459c69cc73de285661971d43311e770898a474c2169749357c3126415f17a19e711badfe0fbbb98f056af8cf99cc6eaad7629a71a
-
Filesize
349KB
MD5553757ec800d8105f948398322267f79
SHA1ca67195818d5a1113b10acbaccee29f554305aa5
SHA256514eeaa34ad5caf4b60b744f75780ab8cd9703eda60f71a4546570ada7eadfc3
SHA5126afedb84c684960ab9c0a36d32176063b320ed80add8730a9fa1d2a3f3fbe22fa5edc135f788db06b45b59743205a8923394828d0074b23d4e68b83cd78b6ca9