Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/10/2024, 01:37
Behavioral task
behavioral1
Sample
acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
Resource
win10v2004-20241007-en
General
-
Target
acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
-
Size
8.2MB
-
MD5
289d273ac47a0259b639ff6d4782cab0
-
SHA1
fed3a1db04bb8fe8104ff15d984d02cdbd0e360d
-
SHA256
acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2
-
SHA512
384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735
-
SSDEEP
49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecX:V8e8e8f8e8e8s
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/files/0x0008000000016d1c-40.dat warzonerat behavioral1/memory/3060-48-0x0000000002EF0000-0x0000000003004000-memory.dmp warzonerat behavioral1/files/0x0008000000016cf0-79.dat warzonerat behavioral1/files/0x000b000000016d2c-93.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
resource yara_rule behavioral1/files/0x0008000000016d1c-40.dat aspack_v212_v242 behavioral1/files/0x0008000000016cf0-79.dat aspack_v212_v242 behavioral1/files/0x000b000000016d2c-93.dat aspack_v212_v242 -
Executes dropped EXE 11 IoCs
pid Process 2864 explorer.exe 452 explorer.exe 2196 spoolsv.exe 2124 spoolsv.exe 2672 spoolsv.exe 2532 spoolsv.exe 2752 spoolsv.exe 952 spoolsv.exe 2916 spoolsv.exe 1584 spoolsv.exe 2152 svchost.exe -
Loads dropped DLL 61 IoCs
pid Process 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 2404 WerFault.exe 452 explorer.exe 452 explorer.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 452 explorer.exe 452 explorer.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 2072 WerFault.exe 452 explorer.exe 452 explorer.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 452 explorer.exe 452 explorer.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 452 explorer.exe 452 explorer.exe 2196 spoolsv.exe 2500 WerFault.exe 2500 WerFault.exe 2500 WerFault.exe 2500 WerFault.exe 2500 WerFault.exe 2500 WerFault.exe 2500 WerFault.exe 1584 spoolsv.exe 1584 spoolsv.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2116 set thread context of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 set thread context of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2864 set thread context of 452 2864 explorer.exe 34 PID 2864 set thread context of 1548 2864 explorer.exe 35 PID 2196 set thread context of 1584 2196 spoolsv.exe 49 PID 2196 set thread context of 2324 2196 spoolsv.exe 50 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
pid pid_target Process procid_target 2404 2124 WerFault.exe 37 1800 2672 WerFault.exe 39 2072 2532 WerFault.exe 41 2616 2752 WerFault.exe 43 1620 952 WerFault.exe 45 2500 2916 WerFault.exe 47 -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 452 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 452 explorer.exe 1584 spoolsv.exe 1584 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 3060 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 30 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 2116 wrote to memory of 2976 2116 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 31 PID 3060 wrote to memory of 2864 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 32 PID 3060 wrote to memory of 2864 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 32 PID 3060 wrote to memory of 2864 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 32 PID 3060 wrote to memory of 2864 3060 acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe 32 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 452 2864 explorer.exe 34 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 2864 wrote to memory of 1548 2864 explorer.exe 35 PID 452 wrote to memory of 2196 452 explorer.exe 36 PID 452 wrote to memory of 2196 452 explorer.exe 36 PID 452 wrote to memory of 2196 452 explorer.exe 36 PID 452 wrote to memory of 2196 452 explorer.exe 36 PID 452 wrote to memory of 2124 452 explorer.exe 37 PID 452 wrote to memory of 2124 452 explorer.exe 37 PID 452 wrote to memory of 2124 452 explorer.exe 37 PID 452 wrote to memory of 2124 452 explorer.exe 37 PID 2124 wrote to memory of 2404 2124 spoolsv.exe 38 PID 2124 wrote to memory of 2404 2124 spoolsv.exe 38 PID 2124 wrote to memory of 2404 2124 spoolsv.exe 38 PID 2124 wrote to memory of 2404 2124 spoolsv.exe 38 PID 452 wrote to memory of 2672 452 explorer.exe 39 PID 452 wrote to memory of 2672 452 explorer.exe 39 PID 452 wrote to memory of 2672 452 explorer.exe 39 PID 452 wrote to memory of 2672 452 explorer.exe 39 PID 2672 wrote to memory of 1800 2672 spoolsv.exe 40 PID 2672 wrote to memory of 1800 2672 spoolsv.exe 40 PID 2672 wrote to memory of 1800 2672 spoolsv.exe 40 PID 2672 wrote to memory of 1800 2672 spoolsv.exe 40 PID 452 wrote to memory of 2532 452 explorer.exe 41 PID 452 wrote to memory of 2532 452 explorer.exe 41 PID 452 wrote to memory of 2532 452 explorer.exe 41 PID 452 wrote to memory of 2532 452 explorer.exe 41 PID 2532 wrote to memory of 2072 2532 spoolsv.exe 42 PID 2532 wrote to memory of 2072 2532 spoolsv.exe 42 PID 2532 wrote to memory of 2072 2532 spoolsv.exe 42 PID 2532 wrote to memory of 2072 2532 spoolsv.exe 42 PID 452 wrote to memory of 2752 452 explorer.exe 43 PID 452 wrote to memory of 2752 452 explorer.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1584 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2324
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2404
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1800
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2072
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2616
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 366⤵
- Loads dropped DLL
- Program crash
PID:1620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 366⤵
- Loads dropped DLL
- Program crash
PID:2500
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵PID:1548
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD5289d273ac47a0259b639ff6d4782cab0
SHA1fed3a1db04bb8fe8104ff15d984d02cdbd0e360d
SHA256acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2
SHA512384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735
-
Filesize
8.2MB
MD5c7609b202d0fc4b6cc45ed7e007f6805
SHA16ff5cc36f97573d6b705c116e9133a9dd574a33e
SHA2562b4d389f6188c14c5d8376887da615e2c72f34dd836c83f2629c01d39692ebad
SHA512819acd6b8b3fe70d37c9c10d5ec9abd548f59a4b00dd95b3c87f3ba85a0d7fc1d026805ff5d9899a54c78adb69584fb8c298e2522d64261503d9ebfd40b62829
-
Filesize
8.2MB
MD54b2cda7ab90b239f7228153f5f40e24c
SHA15979f873a0bd171864c917b0c25835dba0d03440
SHA256e54d2167713ad04de9997b66638d67974405ef0143285b32d516a320cfa2cdc4
SHA512368b0ec578decc87c9d62f256b1dfa5174fe556229806b964a87d4bbe58665ffd1e48dc7da02de49d0663d7f0a3c07555a97e6ad003ff3d004e5bdc0d612c81a