Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe
Resource
win10v2004-20241007-en
General
-
Target
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe
-
Size
3.2MB
-
MD5
590f3c0bd25a3d846e06cac9b630c770
-
SHA1
f4785f1b39db8c980bf53509972ba63af84fcb9e
-
SHA256
024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4
-
SHA512
3b262e63b73bff888e8cd25e3c2630c3686da8ca7cb27ad6168a3be6df7fdeb6da4aa7519973c6e2e5d1d70b6ea1878c8fbb9679b519d807c4f486586a8c4e36
-
SSDEEP
98304:D+8hH93YWcoUP3Tmbw89JcaiBWDBoX88m55:DNd3zm/y88sSi65
Malware Config
Extracted
xworm
-
install_file
Mason.exe
Signatures
-
Detect Neshta payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000015d7e-35.dat family_neshta behavioral1/memory/2524-153-0x0000000001020000-0x00000000015D6000-memory.dmp family_neshta -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/files/0x0007000000012119-8.dat family_xworm behavioral1/memory/1164-15-0x0000000000940000-0x0000000000980000-memory.dmp family_xworm behavioral1/memory/1164-256-0x000000001AD40000-0x000000001AD4E000-memory.dmp family_xworm -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Xworm family
-
Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/files/0x0008000000015d7e-35.dat Nirsoft behavioral1/memory/2524-153-0x0000000001020000-0x00000000015D6000-memory.dmp Nirsoft -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/files/0x0008000000015d7e-35.dat WebBrowserPassView behavioral1/memory/2524-153-0x0000000001020000-0x00000000015D6000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 1504 powershell.exe 1504 powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 1164 wininit.exe 2780 Mason3.exe 2688 3edmrmum.ain.exe 2524 njRAT v0.7D Dangerous Edition 2020 Cracked.exe -
Loads dropped DLL 2 IoCs
pid Process 1164 wininit.exe 1164 wininit.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 33 IoCs
flow ioc 36 raw.githubusercontent.com 13 raw.githubusercontent.com 22 raw.githubusercontent.com 25 raw.githubusercontent.com 29 raw.githubusercontent.com 19 raw.githubusercontent.com 33 raw.githubusercontent.com 5 raw.githubusercontent.com 18 raw.githubusercontent.com 24 raw.githubusercontent.com 4 raw.githubusercontent.com 11 raw.githubusercontent.com 31 raw.githubusercontent.com 15 raw.githubusercontent.com 21 raw.githubusercontent.com 26 raw.githubusercontent.com 27 raw.githubusercontent.com 28 raw.githubusercontent.com 35 raw.githubusercontent.com 9 raw.githubusercontent.com 12 raw.githubusercontent.com 37 raw.githubusercontent.com 20 raw.githubusercontent.com 30 raw.githubusercontent.com 34 raw.githubusercontent.com 8 raw.githubusercontent.com 17 raw.githubusercontent.com 16 raw.githubusercontent.com 23 raw.githubusercontent.com 32 raw.githubusercontent.com 38 raw.githubusercontent.com 10 raw.githubusercontent.com 14 raw.githubusercontent.com -
Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File opened for modification C:\Windows\system32\wbem\Logs\wmiprov.log wmiprvse.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\System32\Tasks\Masonwininit.exe svchost.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File opened for modification C:\Windows\System32\Tasks\Masonwininit.exe svchost.exe File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mason3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njRAT v0.7D Dangerous Edition 2020 Cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2272 SCHTASKS.exe 784 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2780 Mason3.exe 2688 3edmrmum.ain.exe 2688 3edmrmum.ain.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe 2780 Mason3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2688 3edmrmum.ain.exe Token: SeDebugPrivilege 1164 wininit.exe Token: SeDebugPrivilege 2780 Mason3.exe Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeAuditPrivilege 848 svchost.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeAuditPrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2524 njRAT v0.7D Dangerous Edition 2020 Cracked.exe 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2524 njRAT v0.7D Dangerous Edition 2020 Cracked.exe 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1164 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 30 PID 2236 wrote to memory of 1164 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 30 PID 2236 wrote to memory of 1164 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 30 PID 2236 wrote to memory of 2780 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 31 PID 2236 wrote to memory of 2780 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 31 PID 2236 wrote to memory of 2780 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 31 PID 2236 wrote to memory of 2780 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 31 PID 1164 wrote to memory of 2688 1164 wininit.exe 32 PID 1164 wrote to memory of 2688 1164 wininit.exe 32 PID 1164 wrote to memory of 2688 1164 wininit.exe 32 PID 2236 wrote to memory of 2524 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 33 PID 2236 wrote to memory of 2524 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 33 PID 2236 wrote to memory of 2524 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 33 PID 2236 wrote to memory of 2524 2236 024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe 33 PID 2688 wrote to memory of 432 2688 3edmrmum.ain.exe 5 PID 2688 wrote to memory of 476 2688 3edmrmum.ain.exe 6 PID 2688 wrote to memory of 492 2688 3edmrmum.ain.exe 7 PID 2688 wrote to memory of 500 2688 3edmrmum.ain.exe 8 PID 2688 wrote to memory of 596 2688 3edmrmum.ain.exe 9 PID 2688 wrote to memory of 672 2688 3edmrmum.ain.exe 10 PID 2688 wrote to memory of 744 2688 3edmrmum.ain.exe 11 PID 2688 wrote to memory of 812 2688 3edmrmum.ain.exe 12 PID 2688 wrote to memory of 848 2688 3edmrmum.ain.exe 13 PID 2688 wrote to memory of 964 2688 3edmrmum.ain.exe 15 PID 2688 wrote to memory of 236 2688 3edmrmum.ain.exe 16 PID 2688 wrote to memory of 560 2688 3edmrmum.ain.exe 17 PID 2688 wrote to memory of 1044 2688 3edmrmum.ain.exe 18 PID 2688 wrote to memory of 1128 2688 3edmrmum.ain.exe 19 PID 2688 wrote to memory of 1236 2688 3edmrmum.ain.exe 20 PID 2688 wrote to memory of 1280 2688 3edmrmum.ain.exe 21 PID 2688 wrote to memory of 2024 2688 3edmrmum.ain.exe 23 PID 2688 wrote to memory of 1272 2688 3edmrmum.ain.exe 24 PID 2688 wrote to memory of 840 2688 3edmrmum.ain.exe 25 PID 2688 wrote to memory of 2136 2688 3edmrmum.ain.exe 26 PID 2688 wrote to memory of 1668 2688 3edmrmum.ain.exe 27 PID 2688 wrote to memory of 2236 2688 3edmrmum.ain.exe 29 PID 2688 wrote to memory of 1164 2688 3edmrmum.ain.exe 30 PID 1164 wrote to memory of 2272 1164 wininit.exe 34 PID 1164 wrote to memory of 2272 1164 wininit.exe 34 PID 1164 wrote to memory of 2272 1164 wininit.exe 34 PID 2688 wrote to memory of 2272 2688 3edmrmum.ain.exe 34 PID 2688 wrote to memory of 2272 2688 3edmrmum.ain.exe 34 PID 2688 wrote to memory of 1936 2688 3edmrmum.ain.exe 35 PID 2780 wrote to memory of 1504 2780 Mason3.exe 36 PID 2780 wrote to memory of 1504 2780 Mason3.exe 36 PID 2780 wrote to memory of 1504 2780 Mason3.exe 36 PID 2780 wrote to memory of 1504 2780 Mason3.exe 36 PID 2688 wrote to memory of 2052 2688 3edmrmum.ain.exe 37 PID 1164 wrote to memory of 784 1164 wininit.exe 38 PID 1164 wrote to memory of 784 1164 wininit.exe 38 PID 1164 wrote to memory of 784 1164 wininit.exe 38 PID 2688 wrote to memory of 784 2688 3edmrmum.ain.exe 38 PID 2688 wrote to memory of 784 2688 3edmrmum.ain.exe 38 PID 2688 wrote to memory of 568 2688 3edmrmum.ain.exe 39 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 492 wrote to memory of 1164 492 lsass.exe 30 PID 848 wrote to memory of 2536 848 svchost.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:596
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵
- Drops file in System32 directory
PID:1272
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:840
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1236
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2536
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:560
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1044
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"2⤵PID:2024
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2136
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1668
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:492
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:500
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe"C:\Users\Admin\AppData\Local\Temp\024c922fae15af2813dc921bbdba6126c9c1f09c0c8b6ff27f33aafb586120c4N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\wininit.exe"C:\Users\Admin\AppData\Local\Temp\wininit.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\3edmrmum.ain.exe"C:\Users\Admin\AppData\Local\Temp\3edmrmum.ain.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\wininit.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2272
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\wininit.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:784
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mason3.exe"C:\Users\Admin\AppData\Local\Temp\Mason3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
-
C:\Users\Admin\AppData\Local\Temp\njRAT v0.7D Dangerous Edition 2020 Cracked.exe"C:\Users\Admin\AppData\Local\Temp\njRAT v0.7D Dangerous Edition 2020 Cracked.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2524
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1814212700-17768449001299684119-20267964721259443796-1047530541-1392474302203657354"1⤵PID:1936
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "45964904414228279572690300208467406761210910492-2132011180803248333-2135790626"1⤵PID:2052
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2033588419-1740647032148007845212295998991001217971195788020577376212-1571666767"1⤵PID:568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc76d26e01aab774b454e41b32cee75b
SHA17c372927f298393e9052376570f5785801a6b0b1
SHA256968d9ec8f18bdd4bc123ae01a3b2a2f534c3c3dee57b5e8568e7b842ec212f89
SHA512e6f097cd4f43ddac5126910b42e717e2938cf6368e7fc5fd324ebf19fdc46c92e92bfceaf037e1b321763cfbbe1844630555aa14418d70992d84c372256194a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ed72586a38392d95a3acc942381cc87
SHA1f69dffb6c373efde39e53d1472e8493a0a5c1b19
SHA2561dfc78af53f868206c3315c3df4de2452fdad67a3971f6eb6ab93d336b8a20dc
SHA512d921ff1bb3eac4d7a2ae85913274c19050320f3c4f0d92fff6e8d3e2a365d6fd815cbcd8ce1b870daf22851d0b84cc8478df5f3fc0d07f0d603203b1356aa3ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54019087f6b666882697d4a81d77444d2
SHA164c659166e9a569a6328db989351a87c15d3c8b7
SHA256b2efc7768c8c81162fec8ec941359605dc01f114885fba0090e82ca738b00736
SHA5121e7e179c28dfd77c100530ba87621b0ed6d97d9eb1449ddb0b74ea142961a4d9afbd60d58bcfd31d807ffd024c76ccd18a4c50397894f550ef8ef8874f16c7fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575838b6e940a50ec21665b670f2ef572
SHA158c05fd87de9f03c0235aa81434a1984f7113ba4
SHA256c637e998f357aa3a7625cf70ae4c5d60073d16928ee7165e6b93ce6c09acb67c
SHA512fce7012c3856569b88b40d9075f9dfba067c4fcfa9c0cc08442971b0b2166e803685087d3001bb27026456f6701fda94928044146f686969baae3444e6022280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a56ec01da88051a6ce4e8ad549cd4eeb
SHA10145e73bf8543cd674aacf5f259008f77e28633e
SHA25658641f252441f0b2ee482b4ebc1dc950ef5db105b129f15491ff09873cab0c4f
SHA512399c4665e61518804c1b3f5d73c6763e3609963920d78d6597f339ce23726eb2e9e684dee03f8e24ebb0d1e1b4248db7012894c57c708ede6e239a91fac1285c
-
Filesize
161KB
MD594f1ab3a068f83b32639579ec9c5d025
SHA138f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA51244d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
10KB
MD52db3e49b33a30f884ed97cd16195750f
SHA153b4fa3100f397668a172bcd3351c52626fad0fb
SHA256b58aceede49fb4c23b84c37201e7935cdd057f7fa98cb08c051264119182e01b
SHA512194f46f154b513d003ac65ad5ea1eab983eb77bceb9a77518050e88715b88cb83ec6e16e1a78a636209c6f14673363e3a755f518abc018b13e4cb9e99c46efc0
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
5.7MB
MD57e722b5db170c8d147e4b4f15d529356
SHA16575138d70db787bab275b3ec59905c084289302
SHA25630bf1556d685b1ae76c17df52d532e74c4213d3e85a911a0bc56f0260b2ceb5f
SHA5126a9318bb3bace54bdd888be50c78b7b206483cd146ead0f5cb2e8c19dd24ccbb9a7dccef0a4c32cbc846652efa99386012af0359a849c43fb0200dec707f5058
-
Filesize
230KB
MD52acf972a9093e2e363220d4f68c95061
SHA1de7f23b05e44c78af2dae78031a85cb37e1e4362
SHA2566ebf93baa85cdb46f9e0acf8d5feb2bc3cf0c5f615df216974532f2c80bf2f6e
SHA512956c39c6bf39a5656cf1143b336918ebb2baa36e2c18e8fd79729940e4c42f61794050c4bec23e34f1d0da23a72ce28feaeb9781e738794c2af21181391928c0
-
Filesize
145KB
MD519c7052de3b7281b4c1c6bfbb543c5dc
SHA1d2e12081a14c1069c89f2cee7357a559c27786e7
SHA25614ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83
-
Filesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
Filesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
Filesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
Filesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
Filesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
Filesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
Filesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
Filesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
Filesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42