Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe
Resource
win7-20240903-en
General
-
Target
2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe
-
Size
4.6MB
-
MD5
ef95c78351b1b8efaf2f5483ef7052fd
-
SHA1
1353ec5c2936ccb1c73a0004f54a35231d6af670
-
SHA256
d6e6dbcb94ff187fa5275d966b8dec8f67d0e05f2683de719bbd81ddd4e4f7e5
-
SHA512
277604b19a70eb6c468f36ea679adcf739af1b7ee3c14b85e131e49eb50567d373c322c4204ba935e8140ca696126bcf514934072dcc73e89b1474e1bcd3fcbe
-
SSDEEP
98304:ZNudyith6XvmDrF45j9NEsCJAvMZCr72ikrweJSDTEiMLHwvDxl+Ji:Z2fth6XvmDrFQh6sCabyrweJ5iEHcDe8
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.84
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b96-33.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 4084 created 3544 4084 3383528948.exe 56 PID 4084 created 3544 4084 3383528948.exe 56 PID 368 created 3544 368 winupsecvmgr.exe 56 PID 368 created 3544 368 winupsecvmgr.exe 56 PID 368 created 3544 368 winupsecvmgr.exe 56 -
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/368-107-0x00007FF71E250000-0x00007FF71E7E7000-memory.dmp xmrig behavioral2/memory/2396-110-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-113-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-115-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-117-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-119-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-121-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-123-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-126-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-128-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig behavioral2/memory/2396-130-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2217418379.exe -
Executes dropped EXE 9 IoCs
pid Process 3008 8491.exe 3272 2800317469.exe 1800 sysnldcvmr.exe 1384 2217418379.exe 3968 35876223.exe 4896 2851726839.exe 4084 3383528948.exe 2124 1812715143.exe 368 winupsecvmgr.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" 2800317469.exe -
pid Process 5056 powershell.exe 2440 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 368 set thread context of 5024 368 winupsecvmgr.exe 121 PID 368 set thread context of 2396 368 winupsecvmgr.exe 122 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysnldcvmr.exe 2800317469.exe File opened for modification C:\Windows\sysnldcvmr.exe 2800317469.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2800317469.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35876223.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2851726839.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1812715143.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8491.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Internet Explorer\IESettingSync 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 1384 2217418379.exe 4084 3383528948.exe 4084 3383528948.exe 5056 powershell.exe 5056 powershell.exe 4084 3383528948.exe 4084 3383528948.exe 368 winupsecvmgr.exe 368 winupsecvmgr.exe 2440 powershell.exe 2440 powershell.exe 368 winupsecvmgr.exe 368 winupsecvmgr.exe 368 winupsecvmgr.exe 368 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1384 2217418379.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeIncreaseQuotaPrivilege 5056 powershell.exe Token: SeSecurityPrivilege 5056 powershell.exe Token: SeTakeOwnershipPrivilege 5056 powershell.exe Token: SeLoadDriverPrivilege 5056 powershell.exe Token: SeSystemProfilePrivilege 5056 powershell.exe Token: SeSystemtimePrivilege 5056 powershell.exe Token: SeProfSingleProcessPrivilege 5056 powershell.exe Token: SeIncBasePriorityPrivilege 5056 powershell.exe Token: SeCreatePagefilePrivilege 5056 powershell.exe Token: SeBackupPrivilege 5056 powershell.exe Token: SeRestorePrivilege 5056 powershell.exe Token: SeShutdownPrivilege 5056 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeSystemEnvironmentPrivilege 5056 powershell.exe Token: SeRemoteShutdownPrivilege 5056 powershell.exe Token: SeUndockPrivilege 5056 powershell.exe Token: SeManageVolumePrivilege 5056 powershell.exe Token: 33 5056 powershell.exe Token: 34 5056 powershell.exe Token: 35 5056 powershell.exe Token: 36 5056 powershell.exe Token: SeIncreaseQuotaPrivilege 5056 powershell.exe Token: SeSecurityPrivilege 5056 powershell.exe Token: SeTakeOwnershipPrivilege 5056 powershell.exe Token: SeLoadDriverPrivilege 5056 powershell.exe Token: SeSystemProfilePrivilege 5056 powershell.exe Token: SeSystemtimePrivilege 5056 powershell.exe Token: SeProfSingleProcessPrivilege 5056 powershell.exe Token: SeIncBasePriorityPrivilege 5056 powershell.exe Token: SeCreatePagefilePrivilege 5056 powershell.exe Token: SeBackupPrivilege 5056 powershell.exe Token: SeRestorePrivilege 5056 powershell.exe Token: SeShutdownPrivilege 5056 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeSystemEnvironmentPrivilege 5056 powershell.exe Token: SeRemoteShutdownPrivilege 5056 powershell.exe Token: SeUndockPrivilege 5056 powershell.exe Token: SeManageVolumePrivilege 5056 powershell.exe Token: 33 5056 powershell.exe Token: 34 5056 powershell.exe Token: 35 5056 powershell.exe Token: 36 5056 powershell.exe Token: SeIncreaseQuotaPrivilege 5056 powershell.exe Token: SeSecurityPrivilege 5056 powershell.exe Token: SeTakeOwnershipPrivilege 5056 powershell.exe Token: SeLoadDriverPrivilege 5056 powershell.exe Token: SeSystemProfilePrivilege 5056 powershell.exe Token: SeSystemtimePrivilege 5056 powershell.exe Token: SeProfSingleProcessPrivilege 5056 powershell.exe Token: SeIncBasePriorityPrivilege 5056 powershell.exe Token: SeCreatePagefilePrivilege 5056 powershell.exe Token: SeBackupPrivilege 5056 powershell.exe Token: SeRestorePrivilege 5056 powershell.exe Token: SeShutdownPrivilege 5056 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeSystemEnvironmentPrivilege 5056 powershell.exe Token: SeRemoteShutdownPrivilege 5056 powershell.exe Token: SeUndockPrivilege 5056 powershell.exe Token: SeManageVolumePrivilege 5056 powershell.exe Token: 33 5056 powershell.exe Token: 34 5056 powershell.exe Token: 35 5056 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe 2396 dwm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3008 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 83 PID 2008 wrote to memory of 3008 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 83 PID 2008 wrote to memory of 3008 2008 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 83 PID 3008 wrote to memory of 3272 3008 8491.exe 84 PID 3008 wrote to memory of 3272 3008 8491.exe 84 PID 3008 wrote to memory of 3272 3008 8491.exe 84 PID 3272 wrote to memory of 1800 3272 2800317469.exe 86 PID 3272 wrote to memory of 1800 3272 2800317469.exe 86 PID 3272 wrote to memory of 1800 3272 2800317469.exe 86 PID 1800 wrote to memory of 1384 1800 sysnldcvmr.exe 95 PID 1800 wrote to memory of 1384 1800 sysnldcvmr.exe 95 PID 1384 wrote to memory of 3236 1384 2217418379.exe 96 PID 1384 wrote to memory of 3236 1384 2217418379.exe 96 PID 1384 wrote to memory of 1172 1384 2217418379.exe 98 PID 1384 wrote to memory of 1172 1384 2217418379.exe 98 PID 3236 wrote to memory of 2760 3236 cmd.exe 100 PID 3236 wrote to memory of 2760 3236 cmd.exe 100 PID 1172 wrote to memory of 2888 1172 cmd.exe 101 PID 1172 wrote to memory of 2888 1172 cmd.exe 101 PID 1800 wrote to memory of 3968 1800 sysnldcvmr.exe 106 PID 1800 wrote to memory of 3968 1800 sysnldcvmr.exe 106 PID 1800 wrote to memory of 3968 1800 sysnldcvmr.exe 106 PID 1800 wrote to memory of 4896 1800 sysnldcvmr.exe 107 PID 1800 wrote to memory of 4896 1800 sysnldcvmr.exe 107 PID 1800 wrote to memory of 4896 1800 sysnldcvmr.exe 107 PID 3968 wrote to memory of 4084 3968 35876223.exe 108 PID 3968 wrote to memory of 4084 3968 35876223.exe 108 PID 1800 wrote to memory of 2124 1800 sysnldcvmr.exe 114 PID 1800 wrote to memory of 2124 1800 sysnldcvmr.exe 114 PID 1800 wrote to memory of 2124 1800 sysnldcvmr.exe 114 PID 368 wrote to memory of 5024 368 winupsecvmgr.exe 121 PID 368 wrote to memory of 2396 368 winupsecvmgr.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8491.exe"C:\Users\Admin\AppData\Local\Temp\8491.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2800317469.exeC:\Users\Admin\AppData\Local\Temp\2800317469.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2217418379.exeC:\Users\Admin\AppData\Local\Temp\2217418379.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵PID:2760
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵PID:2888
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\35876223.exeC:\Users\Admin\AppData\Local\Temp\35876223.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3383528948.exeC:\Users\Admin\AppData\Local\Temp\3383528948.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
-
C:\Users\Admin\AppData\Local\Temp\2851726839.exeC:\Users\Admin\AppData\Local\Temp\2851726839.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\1812715143.exeC:\Users\Admin\AppData\Local\Temp\1812715143.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:4908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:5024
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:368
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5fff5cbccb6b31b40f834b8f4778a779a
SHA1899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA5121a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD5b01828ab5fc1101581eb45e11567d3d2
SHA1bebbc259e2b76600ee5298af7833022336f31224
SHA256398fe8b69e1ecfdef069c367483fbcfd7752cd6f7f227f5eb69aba709075e587
SHA512a77ddb436cc36c8a73862f2e2b8c9e20ffa3c187f4de38a3d390388b76f0028996b5a374302ed8a6796e6e7da0444974dffb9274c4e1bd4972ab2b9645bfeff7
-
Filesize
61KB
MD577c5eb90118287f666886fc34210c176
SHA1d7a59bf4f014304e29df1868ef82fe782432120a
SHA25659a96d66d97e202829ea79a5e0bbf71981c05a13ab700b0120f7d99d33515080
SHA5125577d167ad4748ad7917ff3f792a0caa01ba40638bdf7143c1403d2efcad4019f8da49719ae0ad88febdc1ef64207fba7ca5bb96dc12c334571d30e2e8f22cf9
-
Filesize
8KB
MD5cb8420e681f68db1bad5ed24e7b22114
SHA1416fc65d538d3622f5ca71c667a11df88a927c31
SHA2565850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
SHA512baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
53KB
MD584897ca8c1aa06b33248956ac25ec20a
SHA1544d5d5652069b3c5e7e29a1ca3eea46b227bbfe
SHA256023ad16f761a35bd7934e392bcf2bbf702f525303b2964e97c3e50d2d5f3eda1
SHA512c17d0e364cf29055dece3e10896f0bbd0ebdb8d2b1c15fe68ddcd9951dd2d1545362f45ad21f26302f3da2eb2ec81340a027cbd4c75cc28491151ecabae65e95
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
10KB
MD596509ab828867d81c1693b614b22f41d
SHA1c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA256a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
SHA512ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
Filesize
10KB
MD508dafe3bb2654c06ead4bb33fb793df8
SHA1d1d93023f1085eed136c6d225d998abf2d5a5bf0
SHA256fc16c0bf09002c93723b8ab13595db5845a50a1b6a133237ac2d148b0bb41700
SHA5129cf2bd749a9ee6e093979bc0d3aacfba03ad6469c98ff3ef35ce5d1635a052e4068ac50431626f6ba8649361802f7fb2ffffb2b325e2795c54b7014180559c99
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
314KB
MD52dd0a1de870af34d48d43b7cad82b8d9
SHA1440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e
SHA256057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32
SHA51283df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff
-
Filesize
687B
MD5a9c237c6645d55240cdda002fef26737
SHA18a7f5c4cf2fd1c924dd1ec754b1b4c5f65bdda80
SHA2560271d97e4e245364c5c52e66d95baf24b3e00c1c8ea6e2b0da59291115cb6087
SHA512480f28bffb5cb96eaf89f601fbf2de03fc5db04f579108b60de1e5be36ede324fc924f624bc29b42747e96f173a860a6fdbaf6da271b6bffb5b7906d11065555
-
Filesize
19KB
MD5a1d597ef7be818c9fa9daa8f18ebf125
SHA18108290387bfb433c6867d6f29b28f68b6f803c6
SHA256b451d4eb04fbf6ea5a92b2d6d1b911c66ef98b7a438fbc3de867c3e91ba86c7a
SHA5124b7f09b47d182ea45f8ef50dc77e24a9c4e036f15728c11409651d4513a16e8db06f99a8132a363dc0e6870563f1d419c6e8f692ef6d08eaf340401cccc11123