Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
Resource
win10v2004-20241007-en
General
-
Target
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
-
Size
844KB
-
MD5
629379e39d21a96f0f047ae336dd78d0
-
SHA1
3d8a5caf3514bac334189eb8884518e176d5dabe
-
SHA256
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6a
-
SHA512
ff48b2fd8351c8ee31b76d82f5e683816dca9a9421dd1a43f8420772169ac8457fff34e2c359e7b4549a0fa3a730ca15f6395fee50153c0fde66ba4ea793cc16
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\a0440614\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoeko.exe -
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/files/0x0008000000015d59-28.dat modiloader_stage2 behavioral1/memory/2668-46-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 708 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 2076 srRTMxaDv9.exe 2360 zoeko.exe 2668 amhost.exe 2900 amhost.exe 2660 bmhost.exe 336 csrss.exe 1672 cmhost.exe 2320 X 1176 Explorer.EXE 824 dmhost.exe -
Loads dropped DLL 16 IoCs
pid Process 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2076 srRTMxaDv9.exe 2076 srRTMxaDv9.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 1672 cmhost.exe 1672 cmhost.exe 1672 cmhost.exe 2320 X 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /C" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /b" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /B" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /R" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /m" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /A" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /r" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /P" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /H" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /T" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /L" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /l" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /M" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /v" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /e" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /n" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /K" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /y" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /Z" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /t" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /W" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /z" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /i" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /h" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /c" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /D" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /J" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /f" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /N" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /d" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /g" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /k" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /V" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /x" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /G" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /F" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /u" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /S" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /j" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /Y" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /I" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /Q" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /p" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /s" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /a" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /o" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /O" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /E" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /w" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /X" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /q" zoeko.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoeko = "C:\\Users\\Admin\\zoeko.exe /y" srRTMxaDv9.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1692 tasklist.exe 2808 tasklist.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2668 set thread context of 2900 2668 amhost.exe 37 PID 2660 set thread context of 400 2660 bmhost.exe 39 PID 1672 set thread context of 108 1672 cmhost.exe 44 -
resource yara_rule behavioral1/memory/2900-40-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2900-38-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2900-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2900-51-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2900-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2900-48-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srRTMxaDv9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoeko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 srRTMxaDv9.exe 2076 srRTMxaDv9.exe 2900 amhost.exe 2660 bmhost.exe 2660 bmhost.exe 2660 bmhost.exe 2360 zoeko.exe 2660 bmhost.exe 2360 zoeko.exe 2360 zoeko.exe 2320 X 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2900 amhost.exe 2360 zoeko.exe 2900 amhost.exe 2360 zoeko.exe 2360 zoeko.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeDebugPrivilege 2808 tasklist.exe Token: SeDebugPrivilege 2660 bmhost.exe Token: SeDebugPrivilege 2660 bmhost.exe Token: SeDebugPrivilege 1692 tasklist.exe Token: SeAssignPrimaryTokenPrivilege 856 svchost.exe Token: SeIncreaseQuotaPrivilege 856 svchost.exe Token: SeSecurityPrivilege 856 svchost.exe Token: SeTakeOwnershipPrivilege 856 svchost.exe Token: SeLoadDriverPrivilege 856 svchost.exe Token: SeSystemtimePrivilege 856 svchost.exe Token: SeBackupPrivilege 856 svchost.exe Token: SeRestorePrivilege 856 svchost.exe Token: SeShutdownPrivilege 856 svchost.exe Token: SeSystemEnvironmentPrivilege 856 svchost.exe Token: SeUndockPrivilege 856 svchost.exe Token: SeManageVolumePrivilege 856 svchost.exe Token: SeAssignPrimaryTokenPrivilege 856 svchost.exe Token: SeIncreaseQuotaPrivilege 856 svchost.exe Token: SeSecurityPrivilege 856 svchost.exe Token: SeTakeOwnershipPrivilege 856 svchost.exe Token: SeLoadDriverPrivilege 856 svchost.exe Token: SeSystemtimePrivilege 856 svchost.exe Token: SeBackupPrivilege 856 svchost.exe Token: SeRestorePrivilege 856 svchost.exe Token: SeShutdownPrivilege 856 svchost.exe Token: SeSystemEnvironmentPrivilege 856 svchost.exe Token: SeUndockPrivilege 856 svchost.exe Token: SeManageVolumePrivilege 856 svchost.exe Token: SeAssignPrimaryTokenPrivilege 856 svchost.exe Token: SeIncreaseQuotaPrivilege 856 svchost.exe Token: SeSecurityPrivilege 856 svchost.exe Token: SeTakeOwnershipPrivilege 856 svchost.exe Token: SeLoadDriverPrivilege 856 svchost.exe Token: SeSystemtimePrivilege 856 svchost.exe Token: SeBackupPrivilege 856 svchost.exe Token: SeRestorePrivilege 856 svchost.exe Token: SeShutdownPrivilege 856 svchost.exe Token: SeSystemEnvironmentPrivilege 856 svchost.exe Token: SeUndockPrivilege 856 svchost.exe Token: SeManageVolumePrivilege 856 svchost.exe Token: SeAssignPrimaryTokenPrivilege 856 svchost.exe Token: SeIncreaseQuotaPrivilege 856 svchost.exe Token: SeSecurityPrivilege 856 svchost.exe Token: SeTakeOwnershipPrivilege 856 svchost.exe Token: SeLoadDriverPrivilege 856 svchost.exe Token: SeSystemtimePrivilege 856 svchost.exe Token: SeBackupPrivilege 856 svchost.exe Token: SeRestorePrivilege 856 svchost.exe Token: SeShutdownPrivilege 856 svchost.exe Token: SeSystemEnvironmentPrivilege 856 svchost.exe Token: SeUndockPrivilege 856 svchost.exe Token: SeManageVolumePrivilege 856 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 2076 srRTMxaDv9.exe 2360 zoeko.exe 824 dmhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2076 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 30 PID 2128 wrote to memory of 2076 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 30 PID 2128 wrote to memory of 2076 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 30 PID 2128 wrote to memory of 2076 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 30 PID 2076 wrote to memory of 2360 2076 srRTMxaDv9.exe 31 PID 2076 wrote to memory of 2360 2076 srRTMxaDv9.exe 31 PID 2076 wrote to memory of 2360 2076 srRTMxaDv9.exe 31 PID 2076 wrote to memory of 2360 2076 srRTMxaDv9.exe 31 PID 2076 wrote to memory of 2508 2076 srRTMxaDv9.exe 32 PID 2076 wrote to memory of 2508 2076 srRTMxaDv9.exe 32 PID 2076 wrote to memory of 2508 2076 srRTMxaDv9.exe 32 PID 2076 wrote to memory of 2508 2076 srRTMxaDv9.exe 32 PID 2508 wrote to memory of 2808 2508 cmd.exe 34 PID 2508 wrote to memory of 2808 2508 cmd.exe 34 PID 2508 wrote to memory of 2808 2508 cmd.exe 34 PID 2508 wrote to memory of 2808 2508 cmd.exe 34 PID 2128 wrote to memory of 2668 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 36 PID 2128 wrote to memory of 2668 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 36 PID 2128 wrote to memory of 2668 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 36 PID 2128 wrote to memory of 2668 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 36 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2668 wrote to memory of 2900 2668 amhost.exe 37 PID 2128 wrote to memory of 2660 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 38 PID 2128 wrote to memory of 2660 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 38 PID 2128 wrote to memory of 2660 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 38 PID 2128 wrote to memory of 2660 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 38 PID 2660 wrote to memory of 1176 2660 bmhost.exe 21 PID 2660 wrote to memory of 336 2660 bmhost.exe 2 PID 2660 wrote to memory of 400 2660 bmhost.exe 39 PID 2660 wrote to memory of 400 2660 bmhost.exe 39 PID 2660 wrote to memory of 400 2660 bmhost.exe 39 PID 2660 wrote to memory of 400 2660 bmhost.exe 39 PID 2660 wrote to memory of 400 2660 bmhost.exe 39 PID 2128 wrote to memory of 1672 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 41 PID 2128 wrote to memory of 1672 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 41 PID 2128 wrote to memory of 1672 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 41 PID 2128 wrote to memory of 1672 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 41 PID 1672 wrote to memory of 2320 1672 cmhost.exe 42 PID 1672 wrote to memory of 2320 1672 cmhost.exe 42 PID 1672 wrote to memory of 2320 1672 cmhost.exe 42 PID 1672 wrote to memory of 2320 1672 cmhost.exe 42 PID 2320 wrote to memory of 1176 2320 X 21 PID 336 wrote to memory of 1348 336 csrss.exe 43 PID 336 wrote to memory of 1348 336 csrss.exe 43 PID 1672 wrote to memory of 108 1672 cmhost.exe 44 PID 1672 wrote to memory of 108 1672 cmhost.exe 44 PID 1672 wrote to memory of 108 1672 cmhost.exe 44 PID 1672 wrote to memory of 108 1672 cmhost.exe 44 PID 1672 wrote to memory of 108 1672 cmhost.exe 44 PID 2128 wrote to memory of 824 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 46 PID 2128 wrote to memory of 824 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 46 PID 2128 wrote to memory of 824 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 46 PID 2128 wrote to memory of 824 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 46 PID 2128 wrote to memory of 708 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 47 PID 2128 wrote to memory of 708 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 47 PID 2128 wrote to memory of 708 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 47 PID 2128 wrote to memory of 708 2128 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 47 PID 708 wrote to memory of 1692 708 cmd.exe 49
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:1348
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe"C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\zoeko.exe"C:\Users\Admin\zoeko.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\amhost.exeamhost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:400
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\a0440614\X176.53.17.24:804⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:108
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:824
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f5e66a93bc297ba83db0e7b5564ced3f
SHA1863c519546cfba7531b8ecbf10ae5bede6d2193d
SHA25694257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231
SHA512b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3
-
Filesize
2KB
MD5437156e529053ac020da405e7c0c512f
SHA17a9aaec69647e5447371103631dc87881863418f
SHA2565e2c06ad23798a20a2e312ed1ec5e9a31764d8045e304f3fd07a2103ea94bc0d
SHA51203684d90683c62270000eeb9d543213e2564cd1c05bf4efd38384230f2a25040d8f052ccfd90c88232669e4f70df32592ad69af2f6d536ba768545a71c219edd
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD5b6a9b71e9f58a91b88fcb5f813f2b6bd
SHA1682ee0b10f1f42c6b4cf67ab46d92e8e9b57db96
SHA256f2b2f7e8dcbdc65693f8b279bea9b970163662fc77a61a024ef2f6267a7f4b41
SHA51240a334f0631d2ba246d52752ac61469e05c2847a31450d04157ec9daba40f48ca2e68554c7a61e58e822575c8550f41b98b4e5e1b8bb2622285f30548af8f046
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954
-
Filesize
344KB
MD549a03b3e61801617251172eace3e1482
SHA140a7339d25959ccdf7078288c7ae2c75d83be233
SHA256e9cf523409136fa869ab487b4a348e9e7b82b71bf4aa2c65c5072d00f841cf04
SHA512b695ee74635501c261bfe7b0d4fbe70d0181d799ffced04045e4c252980221841044a2229d11f2160d3c0b8cf9b120355e04cb6267b80f9815c6f1d44e2bdd4a
-
Filesize
53KB
MD54d7cde615a0f534bd5e359951829554b
SHA1c885d00d9000f2a5dbc78f6193a052b36f4fe968
SHA256414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a
SHA51233d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4
-
Filesize
4KB
MD5878f9b6da85cb98fcbdf6abd1730a32f
SHA1343007e658ea541f4680b4edf4513e69e1cc18a6
SHA25675b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d
SHA5125425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293
-
Filesize
5KB
MD59d7ec1e355ac35cbe6991721ef5ae3b8
SHA1c35a00bd35c6e4a7516b93947be08ead966347e8
SHA25668a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98
SHA512b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0