Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe
Resource
win10v2004-20241007-en
General
-
Target
9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe
-
Size
89KB
-
MD5
26a54ba706d264525c39ac505c6f39a5
-
SHA1
192b9145c7bde0e1c12877dad94798cb89ce1f14
-
SHA256
9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4
-
SHA512
6aa5425a38ad8a3cd5b516fb88df1488dc8752c6c57451bb92e5e3ae39290c94116bef1b0c071d0e5faf8b908794d6caf33e83980bb2c05c2aa548c9dd795dc2
-
SSDEEP
1536:qLSA8rrJzn/wfFD7We37WIsqaV2Be/BhB88KsbuIB7BR9L4DT2EnINb:qLSprrJz/G3CuaVienH1KIB6+oQ
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhpabdqd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nickoldp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mlgdhcmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Moqgiopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhnemdbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Midnqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Midnqh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Moqgiopk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Maapjjml.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlgdhcmb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhnemdbf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhpabdqd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogjhnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nickoldp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ogjhnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Maapjjml.exe -
Berbew family
-
Executes dropped EXE 10 IoCs
pid Process 2164 Midnqh32.exe 2936 Moqgiopk.exe 2144 Maapjjml.exe 2180 Mlgdhcmb.exe 2252 Nhnemdbf.exe 2828 Nhpabdqd.exe 2272 Nickoldp.exe 2260 Nmacej32.exe 3020 Ogjhnp32.exe 1952 Opblgehg.exe -
Loads dropped DLL 24 IoCs
pid Process 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 2164 Midnqh32.exe 2164 Midnqh32.exe 2936 Moqgiopk.exe 2936 Moqgiopk.exe 2144 Maapjjml.exe 2144 Maapjjml.exe 2180 Mlgdhcmb.exe 2180 Mlgdhcmb.exe 2252 Nhnemdbf.exe 2252 Nhnemdbf.exe 2828 Nhpabdqd.exe 2828 Nhpabdqd.exe 2272 Nickoldp.exe 2272 Nickoldp.exe 2260 Nmacej32.exe 2260 Nmacej32.exe 3020 Ogjhnp32.exe 3020 Ogjhnp32.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe -
Drops file in System32 directory 30 IoCs
description ioc Process File created C:\Windows\SysWOW64\Bgbjkg32.dll Midnqh32.exe File created C:\Windows\SysWOW64\Faqkji32.dll Maapjjml.exe File created C:\Windows\SysWOW64\Nhpabdqd.exe Nhnemdbf.exe File created C:\Windows\SysWOW64\Ogjhnp32.exe Nmacej32.exe File created C:\Windows\SysWOW64\Ahmjfimi.dll Ogjhnp32.exe File created C:\Windows\SysWOW64\Midnqh32.exe 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe File created C:\Windows\SysWOW64\Moqgiopk.exe Midnqh32.exe File created C:\Windows\SysWOW64\Mlgdhcmb.exe Maapjjml.exe File opened for modification C:\Windows\SysWOW64\Moqgiopk.exe Midnqh32.exe File opened for modification C:\Windows\SysWOW64\Maapjjml.exe Moqgiopk.exe File created C:\Windows\SysWOW64\Opblgehg.exe Ogjhnp32.exe File created C:\Windows\SysWOW64\Ikcpoa32.dll 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe File created C:\Windows\SysWOW64\Ibnjlg32.dll Moqgiopk.exe File opened for modification C:\Windows\SysWOW64\Nhnemdbf.exe Mlgdhcmb.exe File created C:\Windows\SysWOW64\Nmacej32.exe Nickoldp.exe File opened for modification C:\Windows\SysWOW64\Ogjhnp32.exe Nmacej32.exe File created C:\Windows\SysWOW64\Nlnjkhha.dll Nmacej32.exe File opened for modification C:\Windows\SysWOW64\Nickoldp.exe Nhpabdqd.exe File opened for modification C:\Windows\SysWOW64\Midnqh32.exe 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe File created C:\Windows\SysWOW64\Maapjjml.exe Moqgiopk.exe File opened for modification C:\Windows\SysWOW64\Mlgdhcmb.exe Maapjjml.exe File created C:\Windows\SysWOW64\Oipenooj.dll Nhnemdbf.exe File created C:\Windows\SysWOW64\Nickoldp.exe Nhpabdqd.exe File created C:\Windows\SysWOW64\Nhnemdbf.exe Mlgdhcmb.exe File created C:\Windows\SysWOW64\Kanafj32.dll Mlgdhcmb.exe File opened for modification C:\Windows\SysWOW64\Nhpabdqd.exe Nhnemdbf.exe File opened for modification C:\Windows\SysWOW64\Opblgehg.exe Ogjhnp32.exe File created C:\Windows\SysWOW64\Heknhioh.dll Nhpabdqd.exe File opened for modification C:\Windows\SysWOW64\Nmacej32.exe Nickoldp.exe File created C:\Windows\SysWOW64\Gaegla32.dll Nickoldp.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1496 1952 WerFault.exe 39 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moqgiopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mlgdhcmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhnemdbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogjhnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmacej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opblgehg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Midnqh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Maapjjml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhpabdqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nickoldp.exe -
Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Midnqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibnjlg32.dll" Moqgiopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipenooj.dll" Nhnemdbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Midnqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaegla32.dll" Nickoldp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nickoldp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Moqgiopk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mlgdhcmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhnemdbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhpabdqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhnemdbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nhpabdqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heknhioh.dll" Nhpabdqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ogjhnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Maapjjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kanafj32.dll" Mlgdhcmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nickoldp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlnjkhha.dll" Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikcpoa32.dll" 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgbjkg32.dll" Midnqh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Moqgiopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mlgdhcmb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nmacej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahmjfimi.dll" Ogjhnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ogjhnp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Maapjjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faqkji32.dll" Maapjjml.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2164 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 30 PID 1736 wrote to memory of 2164 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 30 PID 1736 wrote to memory of 2164 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 30 PID 1736 wrote to memory of 2164 1736 9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe 30 PID 2164 wrote to memory of 2936 2164 Midnqh32.exe 31 PID 2164 wrote to memory of 2936 2164 Midnqh32.exe 31 PID 2164 wrote to memory of 2936 2164 Midnqh32.exe 31 PID 2164 wrote to memory of 2936 2164 Midnqh32.exe 31 PID 2936 wrote to memory of 2144 2936 Moqgiopk.exe 32 PID 2936 wrote to memory of 2144 2936 Moqgiopk.exe 32 PID 2936 wrote to memory of 2144 2936 Moqgiopk.exe 32 PID 2936 wrote to memory of 2144 2936 Moqgiopk.exe 32 PID 2144 wrote to memory of 2180 2144 Maapjjml.exe 33 PID 2144 wrote to memory of 2180 2144 Maapjjml.exe 33 PID 2144 wrote to memory of 2180 2144 Maapjjml.exe 33 PID 2144 wrote to memory of 2180 2144 Maapjjml.exe 33 PID 2180 wrote to memory of 2252 2180 Mlgdhcmb.exe 34 PID 2180 wrote to memory of 2252 2180 Mlgdhcmb.exe 34 PID 2180 wrote to memory of 2252 2180 Mlgdhcmb.exe 34 PID 2180 wrote to memory of 2252 2180 Mlgdhcmb.exe 34 PID 2252 wrote to memory of 2828 2252 Nhnemdbf.exe 35 PID 2252 wrote to memory of 2828 2252 Nhnemdbf.exe 35 PID 2252 wrote to memory of 2828 2252 Nhnemdbf.exe 35 PID 2252 wrote to memory of 2828 2252 Nhnemdbf.exe 35 PID 2828 wrote to memory of 2272 2828 Nhpabdqd.exe 36 PID 2828 wrote to memory of 2272 2828 Nhpabdqd.exe 36 PID 2828 wrote to memory of 2272 2828 Nhpabdqd.exe 36 PID 2828 wrote to memory of 2272 2828 Nhpabdqd.exe 36 PID 2272 wrote to memory of 2260 2272 Nickoldp.exe 37 PID 2272 wrote to memory of 2260 2272 Nickoldp.exe 37 PID 2272 wrote to memory of 2260 2272 Nickoldp.exe 37 PID 2272 wrote to memory of 2260 2272 Nickoldp.exe 37 PID 2260 wrote to memory of 3020 2260 Nmacej32.exe 38 PID 2260 wrote to memory of 3020 2260 Nmacej32.exe 38 PID 2260 wrote to memory of 3020 2260 Nmacej32.exe 38 PID 2260 wrote to memory of 3020 2260 Nmacej32.exe 38 PID 3020 wrote to memory of 1952 3020 Ogjhnp32.exe 39 PID 3020 wrote to memory of 1952 3020 Ogjhnp32.exe 39 PID 3020 wrote to memory of 1952 3020 Ogjhnp32.exe 39 PID 3020 wrote to memory of 1952 3020 Ogjhnp32.exe 39 PID 1952 wrote to memory of 1496 1952 Opblgehg.exe 40 PID 1952 wrote to memory of 1496 1952 Opblgehg.exe 40 PID 1952 wrote to memory of 1496 1952 Opblgehg.exe 40 PID 1952 wrote to memory of 1496 1952 Opblgehg.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe"C:\Users\Admin\AppData\Local\Temp\9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\Midnqh32.exeC:\Windows\system32\Midnqh32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\Moqgiopk.exeC:\Windows\system32\Moqgiopk.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Maapjjml.exeC:\Windows\system32\Maapjjml.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\Mlgdhcmb.exeC:\Windows\system32\Mlgdhcmb.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Nhnemdbf.exeC:\Windows\system32\Nhnemdbf.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\Nhpabdqd.exeC:\Windows\system32\Nhpabdqd.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\Nickoldp.exeC:\Windows\system32\Nickoldp.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Nmacej32.exeC:\Windows\system32\Nmacej32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\Ogjhnp32.exeC:\Windows\system32\Ogjhnp32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Opblgehg.exeC:\Windows\system32\Opblgehg.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 14012⤵
- Loads dropped DLL
- Program crash
PID:1496
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5a6766e6f9a4f78acd97505961599689d
SHA1420c74e32ce2aa849a3a67f4bb20c3b8c7ce7dca
SHA256cc7eb4ad48467a2c061e7ddbdcbd3d4596c410c680422bd90626b9bdf51d0659
SHA512f1e6713c6dc103387a843bf1d82b6d9213e2a13bc61089c822e64722f1d9a095e5db873365a290a5157a4c51b0db477c5d22aa6afc90906d1903a1e8e6a1b96d
-
Filesize
89KB
MD58503e9be95fdd2932a62c23081396db3
SHA119912063797c4701cb540c59c7bfa69dbe732af4
SHA25685249c943227dff8c4a662302a322f077cd7acd60a71635f4baeddbbf8985821
SHA512b7416076af3a303ca2e913234b552b7d55a1006ec19fc53cef5bc6e5a4de4121f9d0973bdc73c1c2f64ce7eb4874588a6342039ff1e51e43ce39213ed7607627
-
Filesize
89KB
MD5acafca886fed2063293232b2254a368c
SHA192aa7fb73e9a5e31b87a71cde149e39c33511dce
SHA256e642ff0e80d0945616787bb839dda5170e057df16aa741b8ba9d2ebf3f6ed469
SHA5124ce7f67f80a9fde1699bb8ec6f99ce625071fd629b1ea4d74c1320a781527e43b7b5405a162d9e85ca19a8a7b75911ef15b8bfc1fbea5ae4058eb20e214ede81
-
Filesize
89KB
MD54e04414afcc4e6e66fdb1365ebee6b69
SHA1913a286320fbeb6adb7466f11a3ee63ce5899f15
SHA256b30bb222aee0001abe3cb5785d8c2e8695d6c6e099f5b2ab753061994a6605fd
SHA512daeb246ce9e94a3e613ac9fe4d94e715b6c20d54ebf202444fe3b4007bb24aa25054b4c22bae3112ff107d6aed1931917e59371ac5d423bd77ed95ef17073d5e
-
Filesize
89KB
MD529a35c0c90f8d90b8135c41acd8077cc
SHA1171e22dcca178866133e7628f753488ac1c6a40e
SHA256fd0dc7ddd4f418475f5456bb812186ea9b94763e5a9e433ac2c774eb52a33bc8
SHA5124cf34df4501c212a8d574bd17b683849c8183c3bdf82f7055b19f16d4de0a8b6e4c53ec349db15325aafa7818253872b6206c5c63a35598e88c330eb72c1df9b
-
Filesize
89KB
MD5046e1daffb765252ef0a9d4ec8a435bb
SHA1c334c207eda90b73fb649525dc73a204ff997a0e
SHA256b271d800936cdcb11440444ee5b17cb119e1bffaaf2fbc1c429afa301ed93e24
SHA512d3dc69c64f930f0fdaa7b8186e3b12398c024b6308d18137cf8feb564d8b3d4b75f131ae60f890970bf8147b9deaa57be51d83b383d995adb48d6654d4fdc060
-
Filesize
89KB
MD514327fe9d2ef4f9b569647308eb36123
SHA1a5b2738eda8638f1f93b8190e41da7400a4831bf
SHA2561cf1f86f7e711331109237a088a00fdefdf1af9ad3a85adb7db9db460e8f83e3
SHA51260e72fbb1219bfb5da77c949476c09771c40227a0f446592ff129dc417bf2de8c8cb8475b60273cb3726851c324bf74fb7240f4cc041a2a28b944bcdea324620
-
Filesize
89KB
MD5d287abbe60fc750b45df5c01c1aef407
SHA1579e57ea051ed34582c4c304d8aa62b12fdda446
SHA2569079c864c0ae79f6fdff693f339d311ce68104af13d1b3c0adf9eaa839bbbc4d
SHA512c65b26f180885148eb51ff88081c1f0924e49e9b758894cd161ffa12a6f4dfb21f700b88117cf7bcb8e6ee4fb9350cf77c8534bffc862deaa3335b28d9a08de9
-
Filesize
89KB
MD5995363188352ea5dfab8a5b21c42a8e1
SHA17d53c37b136733908185502ab92b85fab1463f2c
SHA25693b30ab3e53137edbdd49dabee1570b1b0872ad54eae807f878ccb5ffe4b410e
SHA5120d44a03df6170b09209a9c2b1fec5479b4ba651b7a61def54fcb863d0bc60d952760f25e865c1a5ec59c046f4f82ed44169fa860ffc6be4e2c496ccf05b4a1bb
-
Filesize
89KB
MD5dc99a12ef305a0b3fb8ac71c3710da01
SHA1609ebc33568888a4f6a60b5dcc37575056d62bf1
SHA256e38c400c6bd5084949f5ca71d172eedb225870529bcc08273b2f96ad47168758
SHA51227d453a71e08fc2147d582c4ae15a212ffe0b1cbdfc877dcbeb55c7f7b70de000078a49fa825c2b9c32475d1ca57fef6a99b2bb4ecc5bfefe40d938511db79b4
-
Filesize
89KB
MD504733f62403618b8128d943345810315
SHA122d5461bf1b404e4fa6c5367580c842c7154a1d9
SHA256f4de2918b95512c5950cf729bc929623a9d44e639c9c8b3acb24356a55962356
SHA512e8753f61cf98283208f91d41dcb4fed99195ed2461e08ae437428c81d274def294ba688e747ecc97ca17191e5ccd34d0a6923868423e458860d2d138e4d8916f