Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 03:09
Behavioral task
behavioral1
Sample
f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe
Resource
win10v2004-20241007-en
General
-
Target
f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe
-
Size
2.1MB
-
MD5
38d3095d1b748cd53c65395718d7c5f4
-
SHA1
3c0221471b641a641a9141a731f6ee09663e6538
-
SHA256
f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6
-
SHA512
f0ab6ed5dfa52d8159c5090fd96087ba8e89c26c2fdb90fae3f4d19b6952250ecd49846b9198d7c77affb6fabe3a0e53758392409a73552b202591433afc03e6
-
SSDEEP
49152:ZnsHyjtk2MYC5GDqkwkn9IMHea2A07SXq6zMaPCSO:Znsmtk2acdnV+FSvPCt
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBLXFG.lnk ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
Executes dropped EXE 5 IoCs
pid Process 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 2908 Synaptics.exe 2628 ._cache_Synaptics.exe 2180 TXAASJ.exe 1436 TXAASJ.exe -
Loads dropped DLL 6 IoCs
pid Process 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 2908 Synaptics.exe 2908 Synaptics.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\BBLXFG = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\TXAASJ.exe\"" ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000c00000001202c-4.dat autoit_exe behavioral1/files/0x0008000000016c66-14.dat autoit_exe behavioral1/memory/1988-27-0x0000000000400000-0x0000000000620000-memory.dmp autoit_exe behavioral1/memory/2908-88-0x0000000000400000-0x0000000000620000-memory.dmp autoit_exe behavioral1/memory/2908-89-0x0000000000400000-0x0000000000620000-memory.dmp autoit_exe behavioral1/memory/2908-120-0x0000000000400000-0x0000000000620000-memory.dmp autoit_exe behavioral1/memory/2908-125-0x0000000000400000-0x0000000000620000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXAASJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXAASJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2876 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2020 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1884 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 30 PID 1988 wrote to memory of 1884 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 30 PID 1988 wrote to memory of 1884 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 30 PID 1988 wrote to memory of 1884 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 30 PID 1988 wrote to memory of 2908 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 31 PID 1988 wrote to memory of 2908 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 31 PID 1988 wrote to memory of 2908 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 31 PID 1988 wrote to memory of 2908 1988 f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 31 PID 2908 wrote to memory of 2628 2908 Synaptics.exe 32 PID 2908 wrote to memory of 2628 2908 Synaptics.exe 32 PID 2908 wrote to memory of 2628 2908 Synaptics.exe 32 PID 2908 wrote to memory of 2628 2908 Synaptics.exe 32 PID 1884 wrote to memory of 2240 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 33 PID 1884 wrote to memory of 2240 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 33 PID 1884 wrote to memory of 2240 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 33 PID 1884 wrote to memory of 2240 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 33 PID 1884 wrote to memory of 2704 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 35 PID 1884 wrote to memory of 2704 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 35 PID 1884 wrote to memory of 2704 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 35 PID 1884 wrote to memory of 2704 1884 ._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe 35 PID 2240 wrote to memory of 2876 2240 cmd.exe 36 PID 2240 wrote to memory of 2876 2240 cmd.exe 36 PID 2240 wrote to memory of 2876 2240 cmd.exe 36 PID 2240 wrote to memory of 2876 2240 cmd.exe 36 PID 1124 wrote to memory of 2180 1124 taskeng.exe 42 PID 1124 wrote to memory of 2180 1124 taskeng.exe 42 PID 1124 wrote to memory of 2180 1124 taskeng.exe 42 PID 1124 wrote to memory of 2180 1124 taskeng.exe 42 PID 1124 wrote to memory of 1436 1124 taskeng.exe 43 PID 1124 wrote to memory of 1436 1124 taskeng.exe 43 PID 1124 wrote to memory of 1436 1124 taskeng.exe 43 PID 1124 wrote to memory of 1436 1124 taskeng.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe"C:\Users\Admin\AppData\Local\Temp\f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn BBLXFG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn BBLXFG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2876
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\BBLXFG.vbs3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2020
-
C:\Windows\system32\taskeng.exetaskeng.exe {730F3410-0DDF-47A2-ABBA-0E40627EECFD} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exeC:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exeC:\Users\Admin\AppData\Roaming\Windata\TXAASJ.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD538d3095d1b748cd53c65395718d7c5f4
SHA13c0221471b641a641a9141a731f6ee09663e6538
SHA256f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6
SHA512f0ab6ed5dfa52d8159c5090fd96087ba8e89c26c2fdb90fae3f4d19b6952250ecd49846b9198d7c77affb6fabe3a0e53758392409a73552b202591433afc03e6
-
Filesize
964B
MD5bc80130aea11ad9471ee84d7f9acb927
SHA1a60a848576a7eb432a5870ee49cfae862b708c2c
SHA25684fddb6a794a3f013648998d5272451608eb5298e2c91f7dd58056e2181cc025
SHA512c8bf4cfe134511a88cb5cef5f6d04dc4ba953a75b9f19a94dfc444cba1c3a94a35e59dcd1c9eb6f2d1ed347b37df9147f0c374c7a4cd7d22492b8768af5514ee
-
Filesize
24KB
MD5a58d6c35f1b79545f680399fc6364b2a
SHA176eeae71615d3fb1301910a31a8c85992c464f20
SHA2562752b2ead8a6cf7af05abfa99b0ea3d844f43c306476aeb44d51d1ea66c24820
SHA51268af47d15399848e92722c78963923f43926ea8a171620f834983d9a2fe489e5cb3fa9d9dec1a800a0cd99a4a9ed5a0536689609c2743fba6258f742813fed09
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
\Users\Admin\AppData\Local\Temp\._cache_f3724bf49bfd8d11ef1f81b4c6aebc4d3281cecfa357d4fb3ae388a4add242e6.exe
Filesize1.4MB
MD5df6fa61ac1509c2d8b720690829d5634
SHA14430a5461b9c0b5fb8ad0398edad7b5e89159441
SHA25690520e67bffe18505e7d77356a0adbf8ab6663862ef765387eeaf6e2ce5a32d6
SHA5124f953ead572c92bde737227c1afa88bc2d274118e42c99e9245405b4748fa0f258ca8b334ecf219e5c7d2adbbf9185ca4cbbdcc5ef312c26aa7e81bd32d0610c