Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe
Resource
win7-20240903-en
General
-
Target
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe
-
Size
3.2MB
-
MD5
590f3c0bd25a3d846e06cac9b630c770
-
SHA1
f4785f1b39db8c980bf53509972ba63af84fcb9e
-
SHA256
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4
-
SHA512
3b262e63b73bff888e8cd25e3c2630c3686da8ca7cb27ad6168a3be6df7fdeb6da4aa7519973c6e2e5d1d70b6ea1878c8fbb9679b519d807c4f486586a8c4e36
-
SSDEEP
98304:D+8hH93YWcoUP3Tmbw89JcaiBWDBoX88m55:DNd3zm/y88sSi65
Malware Config
Extracted
xworm
-
install_file
Mason.exe
Signatures
-
Detect Neshta payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000015d76-34.dat family_neshta behavioral1/memory/2420-194-0x0000000000990000-0x0000000000F46000-memory.dmp family_neshta -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/files/0x000700000001211a-8.dat family_xworm behavioral1/memory/2260-16-0x0000000000A90000-0x0000000000AD0000-memory.dmp family_xworm behavioral1/memory/2260-225-0x00000000006C0000-0x00000000006CE000-memory.dmp family_xworm -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Xworm family
-
Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/files/0x0008000000015d76-34.dat Nirsoft behavioral1/memory/2420-194-0x0000000000990000-0x0000000000F46000-memory.dmp Nirsoft -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0008000000015d76-34.dat WebBrowserPassView behavioral1/memory/2420-194-0x0000000000990000-0x0000000000F46000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 3004 powershell.exe 3004 powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 2260 wininit.exe 1236 Mason3.exe 1952 r1fsegtl.0jk.exe 2420 njRAT v0.7D Dangerous Edition 2020 Cracked.exe -
Loads dropped DLL 2 IoCs
pid Process 2260 wininit.exe 2260 wininit.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 35 IoCs
flow ioc 4 raw.githubusercontent.com 29 raw.githubusercontent.com 31 raw.githubusercontent.com 37 raw.githubusercontent.com 12 raw.githubusercontent.com 14 raw.githubusercontent.com 19 raw.githubusercontent.com 21 raw.githubusercontent.com 15 raw.githubusercontent.com 33 raw.githubusercontent.com 27 raw.githubusercontent.com 30 raw.githubusercontent.com 34 raw.githubusercontent.com 8 raw.githubusercontent.com 13 raw.githubusercontent.com 17 raw.githubusercontent.com 24 raw.githubusercontent.com 10 raw.githubusercontent.com 23 raw.githubusercontent.com 25 raw.githubusercontent.com 39 raw.githubusercontent.com 5 raw.githubusercontent.com 16 raw.githubusercontent.com 18 raw.githubusercontent.com 26 raw.githubusercontent.com 32 raw.githubusercontent.com 36 raw.githubusercontent.com 38 raw.githubusercontent.com 9 raw.githubusercontent.com 11 raw.githubusercontent.com 20 raw.githubusercontent.com 22 raw.githubusercontent.com 28 raw.githubusercontent.com 35 raw.githubusercontent.com 40 raw.githubusercontent.com -
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\System32\Tasks\Masonwininit.exe svchost.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File opened for modification C:\Windows\System32\Tasks\Masonwininit.exe svchost.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mason3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njRAT v0.7D Dangerous Edition 2020 Cracked.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 lsass.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2d\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 900 SCHTASKS.exe 1992 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1236 Mason3.exe 1952 r1fsegtl.0jk.exe 1952 r1fsegtl.0jk.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe 1236 Mason3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2260 wininit.exe Token: SeDebugPrivilege 1952 r1fsegtl.0jk.exe Token: SeDebugPrivilege 1236 Mason3.exe Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeAuditPrivilege 844 svchost.exe Token: SeDebugPrivilege 3004 powershell.exe Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeAssignPrimaryTokenPrivilege 844 svchost.exe Token: SeIncreaseQuotaPrivilege 844 svchost.exe Token: SeSecurityPrivilege 844 svchost.exe Token: SeTakeOwnershipPrivilege 844 svchost.exe Token: SeLoadDriverPrivilege 844 svchost.exe Token: SeSystemtimePrivilege 844 svchost.exe Token: SeBackupPrivilege 844 svchost.exe Token: SeRestorePrivilege 844 svchost.exe Token: SeShutdownPrivilege 844 svchost.exe Token: SeSystemEnvironmentPrivilege 844 svchost.exe Token: SeUndockPrivilege 844 svchost.exe Token: SeManageVolumePrivilege 844 svchost.exe Token: SeAssignPrimaryTokenPrivilege 844 svchost.exe Token: SeIncreaseQuotaPrivilege 844 svchost.exe Token: SeSecurityPrivilege 844 svchost.exe Token: SeTakeOwnershipPrivilege 844 svchost.exe Token: SeLoadDriverPrivilege 844 svchost.exe Token: SeSystemtimePrivilege 844 svchost.exe Token: SeBackupPrivilege 844 svchost.exe Token: SeRestorePrivilege 844 svchost.exe Token: SeShutdownPrivilege 844 svchost.exe Token: SeSystemEnvironmentPrivilege 844 svchost.exe Token: SeUndockPrivilege 844 svchost.exe Token: SeManageVolumePrivilege 844 svchost.exe Token: SeAssignPrimaryTokenPrivilege 844 svchost.exe Token: SeIncreaseQuotaPrivilege 844 svchost.exe Token: SeSecurityPrivilege 844 svchost.exe Token: SeTakeOwnershipPrivilege 844 svchost.exe Token: SeLoadDriverPrivilege 844 svchost.exe Token: SeSystemtimePrivilege 844 svchost.exe Token: SeBackupPrivilege 844 svchost.exe Token: SeRestorePrivilege 844 svchost.exe Token: SeShutdownPrivilege 844 svchost.exe Token: SeSystemEnvironmentPrivilege 844 svchost.exe Token: SeUndockPrivilege 844 svchost.exe Token: SeManageVolumePrivilege 844 svchost.exe Token: SeAssignPrimaryTokenPrivilege 844 svchost.exe Token: SeIncreaseQuotaPrivilege 844 svchost.exe Token: SeSecurityPrivilege 844 svchost.exe Token: SeTakeOwnershipPrivilege 844 svchost.exe Token: SeLoadDriverPrivilege 844 svchost.exe Token: SeSystemtimePrivilege 844 svchost.exe Token: SeBackupPrivilege 844 svchost.exe Token: SeRestorePrivilege 844 svchost.exe Token: SeShutdownPrivilege 844 svchost.exe Token: SeSystemEnvironmentPrivilege 844 svchost.exe Token: SeUndockPrivilege 844 svchost.exe Token: SeManageVolumePrivilege 844 svchost.exe Token: SeAssignPrimaryTokenPrivilege 844 svchost.exe Token: SeIncreaseQuotaPrivilege 844 svchost.exe Token: SeSecurityPrivilege 844 svchost.exe Token: SeTakeOwnershipPrivilege 844 svchost.exe Token: SeLoadDriverPrivilege 844 svchost.exe Token: SeSystemtimePrivilege 844 svchost.exe Token: SeBackupPrivilege 844 svchost.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2420 njRAT v0.7D Dangerous Edition 2020 Cracked.exe 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2420 njRAT v0.7D Dangerous Edition 2020 Cracked.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2260 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 28 PID 2892 wrote to memory of 2260 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 28 PID 2892 wrote to memory of 2260 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 28 PID 2892 wrote to memory of 1236 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 29 PID 2892 wrote to memory of 1236 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 29 PID 2892 wrote to memory of 1236 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 29 PID 2892 wrote to memory of 1236 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 29 PID 2260 wrote to memory of 1952 2260 wininit.exe 30 PID 2260 wrote to memory of 1952 2260 wininit.exe 30 PID 2260 wrote to memory of 1952 2260 wininit.exe 30 PID 2892 wrote to memory of 2420 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 31 PID 2892 wrote to memory of 2420 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 31 PID 2892 wrote to memory of 2420 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 31 PID 2892 wrote to memory of 2420 2892 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe 31 PID 2260 wrote to memory of 1992 2260 wininit.exe 32 PID 2260 wrote to memory of 1992 2260 wininit.exe 32 PID 2260 wrote to memory of 1992 2260 wininit.exe 32 PID 1952 wrote to memory of 428 1952 r1fsegtl.0jk.exe 5 PID 1952 wrote to memory of 472 1952 r1fsegtl.0jk.exe 6 PID 1952 wrote to memory of 488 1952 r1fsegtl.0jk.exe 7 PID 1952 wrote to memory of 496 1952 r1fsegtl.0jk.exe 8 PID 1952 wrote to memory of 592 1952 r1fsegtl.0jk.exe 9 PID 1952 wrote to memory of 668 1952 r1fsegtl.0jk.exe 10 PID 1952 wrote to memory of 732 1952 r1fsegtl.0jk.exe 11 PID 1952 wrote to memory of 804 1952 r1fsegtl.0jk.exe 12 PID 1952 wrote to memory of 844 1952 r1fsegtl.0jk.exe 13 PID 1952 wrote to memory of 960 1952 r1fsegtl.0jk.exe 15 PID 1952 wrote to memory of 236 1952 r1fsegtl.0jk.exe 16 PID 1952 wrote to memory of 344 1952 r1fsegtl.0jk.exe 17 PID 1952 wrote to memory of 1068 1952 r1fsegtl.0jk.exe 18 PID 1952 wrote to memory of 1116 1952 r1fsegtl.0jk.exe 19 PID 1952 wrote to memory of 1160 1952 r1fsegtl.0jk.exe 20 PID 1952 wrote to memory of 1196 1952 r1fsegtl.0jk.exe 21 PID 1952 wrote to memory of 1048 1952 r1fsegtl.0jk.exe 23 PID 1952 wrote to memory of 2076 1952 r1fsegtl.0jk.exe 24 PID 1952 wrote to memory of 1840 1952 r1fsegtl.0jk.exe 25 PID 1952 wrote to memory of 2892 1952 r1fsegtl.0jk.exe 27 PID 1952 wrote to memory of 2260 1952 r1fsegtl.0jk.exe 28 PID 1952 wrote to memory of 1992 1952 r1fsegtl.0jk.exe 32 PID 1952 wrote to memory of 2428 1952 r1fsegtl.0jk.exe 33 PID 1236 wrote to memory of 3004 1236 Mason3.exe 34 PID 1236 wrote to memory of 3004 1236 Mason3.exe 34 PID 1236 wrote to memory of 3004 1236 Mason3.exe 34 PID 1236 wrote to memory of 3004 1236 Mason3.exe 34 PID 1952 wrote to memory of 3000 1952 r1fsegtl.0jk.exe 35 PID 2260 wrote to memory of 900 2260 wininit.exe 36 PID 2260 wrote to memory of 900 2260 wininit.exe 36 PID 2260 wrote to memory of 900 2260 wininit.exe 36 PID 1952 wrote to memory of 900 1952 r1fsegtl.0jk.exe 36 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 488 wrote to memory of 2260 488 lsass.exe 28 PID 844 wrote to memory of 604 844 svchost.exe 38 PID 844 wrote to memory of 604 844 svchost.exe 38 PID 844 wrote to memory of 604 844 svchost.exe 38 PID 1952 wrote to memory of 604 1952 r1fsegtl.0jk.exe 38 PID 592 wrote to memory of 3028 592 svchost.exe 39 PID 592 wrote to memory of 3028 592 svchost.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:1048
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵PID:3028
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
PID:732
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:804
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1160
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:604
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
- Modifies data under HKEY_USERS
PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1068
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2076
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1840
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:488
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:496
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe"C:\Users\Admin\AppData\Local\Temp\024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\wininit.exe"C:\Users\Admin\AppData\Local\Temp\wininit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\r1fsegtl.0jk.exe"C:\Users\Admin\AppData\Local\Temp\r1fsegtl.0jk.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\wininit.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:1992
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\wininit.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:900
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mason3.exe"C:\Users\Admin\AppData\Local\Temp\Mason3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Users\Admin\AppData\Local\Temp\njRAT v0.7D Dangerous Edition 2020 Cracked.exe"C:\Users\Admin\AppData\Local\Temp\njRAT v0.7D Dangerous Edition 2020 Cracked.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2420
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-887035471-6573071781093122018-5219835501910751559264275529-20426618851646398835"1⤵PID:2428
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "153973666921275995979528176921569510821-1031311966543849358-15361348011302167483"1⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
10KB
MD52db3e49b33a30f884ed97cd16195750f
SHA153b4fa3100f397668a172bcd3351c52626fad0fb
SHA256b58aceede49fb4c23b84c37201e7935cdd057f7fa98cb08c051264119182e01b
SHA512194f46f154b513d003ac65ad5ea1eab983eb77bceb9a77518050e88715b88cb83ec6e16e1a78a636209c6f14673363e3a755f518abc018b13e4cb9e99c46efc0
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
5.7MB
MD57e722b5db170c8d147e4b4f15d529356
SHA16575138d70db787bab275b3ec59905c084289302
SHA25630bf1556d685b1ae76c17df52d532e74c4213d3e85a911a0bc56f0260b2ceb5f
SHA5126a9318bb3bace54bdd888be50c78b7b206483cd146ead0f5cb2e8c19dd24ccbb9a7dccef0a4c32cbc846652efa99386012af0359a849c43fb0200dec707f5058
-
Filesize
230KB
MD52acf972a9093e2e363220d4f68c95061
SHA1de7f23b05e44c78af2dae78031a85cb37e1e4362
SHA2566ebf93baa85cdb46f9e0acf8d5feb2bc3cf0c5f615df216974532f2c80bf2f6e
SHA512956c39c6bf39a5656cf1143b336918ebb2baa36e2c18e8fd79729940e4c42f61794050c4bec23e34f1d0da23a72ce28feaeb9781e738794c2af21181391928c0
-
Filesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
Filesize
150KB
MD5540138285295c68de32a419b7d9de687
SHA11cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56
SHA25633867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb
SHA5127c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a
-
Filesize
141KB
MD5831dbe568992299e589143ee8898e131
SHA1737726173aab8b76fe1f98104d72bb91abd273bf
SHA2564f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405
SHA51239015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139
-
Filesize
138KB
MD5cf82e7354e591c1408eb2cc0e29dd274
SHA17e91bd50c3e6b64b81e2b5c1ce723f52e34748e9
SHA25659b5e6fbbe68f47db14a3c045b0ac1abb026c626ca4bee708fbd3940e6d2e06d
SHA51298bd4809c1c418be4100096bc9df328d2ad435c5615c082fa2bfa424935203107015862cd9c1737800b7f7bd020fea4538c325707927c1557bc3efebffb27620
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
668KB
MD55026297c7c445e7f6f705906a6f57c02
SHA14ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA5125be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d
-
Filesize
634KB
MD51c678ee06bd02b5d9e4d51c3a4ec2d2b
SHA190aa7fdfaaa37fb4f2edfc8efc3994871087dedb
SHA2562d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3
SHA512ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32
-
Filesize
715KB
MD5340af83514a525c50ffbbf8475ed62b7
SHA1e2f382ae75afe7df8a323320bbb2aafa1ff6e407
SHA256fb298e9a90476b4698def395a8ee1974c1cee3959b658662c730da915caea417
SHA5128236aab579456ef4614ddd5fbfe72d0b0b26617c43a9cd53c3de56d3ac052eee8ca7d70749aaca0692855ecd4fd5f1460ac0b1dd30481dee519b910755c1cc2d
-
Filesize
715KB
MD5718bb9564980029a2e3341093a4bb082
SHA18953d96e47b65c2c70f2bcc3d9e2e7c55d41ee61
SHA256ad7b5314ef00ce846ae2c91a32dd1c1f2b4905cf182005e251ad6d4af66cc977
SHA5123f22961d108271dc098ae2c75d217991da38c18a587b44abd74da853ea26d171ca1a507c3200f3b7c2a8175bfff5a8b968a551a4804082064dc6f2ef98b5432d
-
Filesize
710KB
MD566fd0e1999023d23c9f8e3cd7a92af77
SHA1e0e61df319ddbc7c9d425612295f825c47888658
SHA256bdbadcf6f408c6d223974d52a69413aebe1d50ac7eaeacefa2beb2f7321355d0
SHA512b8924cdf53eb5589820a16890fa7abdca20dfc3ca44063d3fdaef484f506419dbf9cd660bc80e8dfe7b7eba7d9db8fe0046accc1fca8d3faf70dedfa1ee0e68f
-
Filesize
394KB
MD524da30cbb5f0fe4939862880e72cc32c
SHA19132497736f52dae62b79be1677c05e32a7ba2ab
SHA256a11a4228f8485db2f90466651f6cab07245a8ff5b3448636ab0abc4d618a4a1f
SHA512332a57e8f0e8d7f82044f90388afd7509768ecb3f657c6be12d1f51ec1c66b8886c30d4b4a42d3a64c3e0d8b76d7cc86a1ac3b92713a68a62c12fdae6a77d6c2
-
Filesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
Filesize
161KB
MD594f1ab3a068f83b32639579ec9c5d025
SHA138f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA51244d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c