Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
Resource
win10v2004-20241007-en
General
-
Target
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe
-
Size
844KB
-
MD5
629379e39d21a96f0f047ae336dd78d0
-
SHA1
3d8a5caf3514bac334189eb8884518e176d5dabe
-
SHA256
5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6a
-
SHA512
ff48b2fd8351c8ee31b76d82f5e683816dca9a9421dd1a43f8420772169ac8457fff34e2c359e7b4549a0fa3a730ca15f6395fee50153c0fde66ba4ea793cc16
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiaije.exe -
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/files/0x000300000001e747-38.dat modiloader_stage2 behavioral2/memory/2424-51-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation srRTMxaDv9.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe -
Executes dropped EXE 8 IoCs
pid Process 744 srRTMxaDv9.exe 2424 amhost.exe 3628 hiaije.exe 4384 amhost.exe 2652 bmhost.exe 2160 cmhost.exe 3028 X 4448 dmhost.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /N" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /I" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /e" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /B" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /X" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /S" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /f" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /z" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /T" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /G" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /r" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /E" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /P" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /U" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /C" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /d" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /V" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /M" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /y" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /A" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /S" srRTMxaDv9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /Z" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /u" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /W" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /R" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /i" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /l" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /K" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /J" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /w" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /n" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /t" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /s" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /b" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /v" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /a" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /Q" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /H" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /m" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /j" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /c" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /D" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /q" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /L" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /F" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /p" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /h" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /O" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /o" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /k" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /Y" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /g" hiaije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hiaije = "C:\\Users\\Admin\\hiaije.exe /x" hiaije.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2748 tasklist.exe 2496 tasklist.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2424 set thread context of 4384 2424 amhost.exe 92 PID 2652 set thread context of 1004 2652 bmhost.exe 94 PID 2160 set thread context of 2704 2160 cmhost.exe 111 -
resource yara_rule behavioral2/memory/4384-46-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4384-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4384-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4384-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4384-45-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srRTMxaDv9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hiaije.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmhost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 744 srRTMxaDv9.exe 744 srRTMxaDv9.exe 744 srRTMxaDv9.exe 744 srRTMxaDv9.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 3028 X 3028 X 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe 4384 amhost.exe 4384 amhost.exe 4384 amhost.exe 3628 hiaije.exe 3628 hiaije.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2748 tasklist.exe Token: SeDebugPrivilege 2652 bmhost.exe Token: SeDebugPrivilege 2160 cmhost.exe Token: SeDebugPrivilege 2496 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 744 srRTMxaDv9.exe 3628 hiaije.exe 4448 dmhost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 408 wrote to memory of 744 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 83 PID 408 wrote to memory of 744 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 83 PID 408 wrote to memory of 744 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 83 PID 408 wrote to memory of 2424 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 85 PID 408 wrote to memory of 2424 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 85 PID 408 wrote to memory of 2424 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 85 PID 744 wrote to memory of 3628 744 srRTMxaDv9.exe 86 PID 744 wrote to memory of 3628 744 srRTMxaDv9.exe 86 PID 744 wrote to memory of 3628 744 srRTMxaDv9.exe 86 PID 744 wrote to memory of 800 744 srRTMxaDv9.exe 87 PID 744 wrote to memory of 800 744 srRTMxaDv9.exe 87 PID 744 wrote to memory of 800 744 srRTMxaDv9.exe 87 PID 800 wrote to memory of 2748 800 cmd.exe 89 PID 800 wrote to memory of 2748 800 cmd.exe 89 PID 800 wrote to memory of 2748 800 cmd.exe 89 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 2424 wrote to memory of 4384 2424 amhost.exe 92 PID 408 wrote to memory of 2652 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 93 PID 408 wrote to memory of 2652 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 93 PID 408 wrote to memory of 2652 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 93 PID 2652 wrote to memory of 1004 2652 bmhost.exe 94 PID 2652 wrote to memory of 1004 2652 bmhost.exe 94 PID 2652 wrote to memory of 1004 2652 bmhost.exe 94 PID 2652 wrote to memory of 1004 2652 bmhost.exe 94 PID 408 wrote to memory of 2160 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 96 PID 408 wrote to memory of 2160 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 96 PID 408 wrote to memory of 2160 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 96 PID 2160 wrote to memory of 3028 2160 cmhost.exe 97 PID 2160 wrote to memory of 3028 2160 cmhost.exe 97 PID 3028 wrote to memory of 3944 3028 X 98 PID 3028 wrote to memory of 3944 3028 X 98 PID 3028 wrote to memory of 3944 3028 X 98 PID 2160 wrote to memory of 2704 2160 cmhost.exe 111 PID 2160 wrote to memory of 2704 2160 cmhost.exe 111 PID 2160 wrote to memory of 2704 2160 cmhost.exe 111 PID 2160 wrote to memory of 2704 2160 cmhost.exe 111 PID 408 wrote to memory of 4448 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 114 PID 408 wrote to memory of 4448 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 114 PID 408 wrote to memory of 4448 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 114 PID 408 wrote to memory of 1984 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 118 PID 408 wrote to memory of 1984 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 118 PID 408 wrote to memory of 1984 408 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe 118 PID 1984 wrote to memory of 2496 1984 cmd.exe 120 PID 1984 wrote to memory of 2496 1984 cmd.exe 120 PID 1984 wrote to memory of 2496 1984 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe"C:\Users\Admin\AppData\Local\Temp\5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\hiaije.exe"C:\Users\Admin\hiaije.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\amhost.exeamhost.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1004
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\e12f23b0\X176.53.17.24:803⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Modifies registry class
PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2704
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 5bce9617c0bd6ae54072dab72f2aa7531ea4a083e168b8716f1fdbe9141e5e6aN.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD5b6a9b71e9f58a91b88fcb5f813f2b6bd
SHA1682ee0b10f1f42c6b4cf67ab46d92e8e9b57db96
SHA256f2b2f7e8dcbdc65693f8b279bea9b970163662fc77a61a024ef2f6267a7f4b41
SHA51240a334f0631d2ba246d52752ac61469e05c2847a31450d04157ec9daba40f48ca2e68554c7a61e58e822575c8550f41b98b4e5e1b8bb2622285f30548af8f046
-
Filesize
344KB
MD5f63e18a48bb77839184e62d308e2a577
SHA1777b479577e5b91452bff9a6e3b71b54807e48b7
SHA25643c79a7dba31448bbab72f23bb2f12aa1ee7d8b0dbbc679ecbff8a43f547ab8b
SHA512fab2f4e42d2a087b3fb04f0289cd2e1c289f7f247525d2b1e6cf98c2c44159cd73fa578c6203538b5479402c9629c2b4df37b7103d8aa64215e253e47e40349f
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954