Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe
Resource
win10v2004-20241007-en
General
-
Target
d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe
-
Size
455KB
-
MD5
8144f89f4a1111ef565101610e224adb
-
SHA1
91e78ca34e5d6c3d7d780b88f26c88491f53826e
-
SHA256
d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b
-
SHA512
d57070c2099c514b2a207f5b367e05fec0083dce726d5067ce304bf0a79754e0b93781fbad8a311c10afb368c40933bd505a177620a34585dde34f5cc29496fe
-
SSDEEP
6144:aBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F88LpIh9jil:VpQD+mO5KWy/zrVbt4fcYv9U9jI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2000 LSASS.exe 2872 LSASS.exe -
Loads dropped DLL 2 IoCs
pid Process 2000 LSASS.exe 2000 LSASS.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUtils = "C:\\Windows\\LSASS.exe" REG.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: LSASS.exe File opened (read-only) \??\O: LSASS.exe File opened (read-only) \??\Q: LSASS.exe File opened (read-only) \??\S: LSASS.exe File opened (read-only) \??\W: LSASS.exe File opened (read-only) \??\X: LSASS.exe File opened (read-only) \??\K: LSASS.exe File opened (read-only) \??\R: LSASS.exe File opened (read-only) \??\T: LSASS.exe File opened (read-only) \??\Z: LSASS.exe File opened (read-only) \??\E: LSASS.exe File opened (read-only) \??\G: LSASS.exe File opened (read-only) \??\H: LSASS.exe File opened (read-only) \??\L: LSASS.exe File opened (read-only) \??\P: LSASS.exe File opened (read-only) \??\V: LSASS.exe File opened (read-only) \??\I: LSASS.exe File opened (read-only) \??\J: LSASS.exe File opened (read-only) \??\M: LSASS.exe File opened (read-only) \??\U: LSASS.exe File opened (read-only) \??\Y: LSASS.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf LSASS.exe File opened for modification C:\autorun.inf LSASS.exe File created F:\autorun.inf LSASS.exe File opened for modification F:\autorun.inf LSASS.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\LSASS.exe d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe File opened for modification C:\Windows\LSASS.exe d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe File opened for modification C:\Windows\LSASS.exe LSASS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSASS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2872 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe 2000 LSASS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2000 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 30 PID 2368 wrote to memory of 2000 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 30 PID 2368 wrote to memory of 2000 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 30 PID 2368 wrote to memory of 2000 2368 d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe 30 PID 2000 wrote to memory of 2740 2000 LSASS.exe 31 PID 2000 wrote to memory of 2740 2000 LSASS.exe 31 PID 2000 wrote to memory of 2740 2000 LSASS.exe 31 PID 2000 wrote to memory of 2740 2000 LSASS.exe 31 PID 2000 wrote to memory of 3008 2000 LSASS.exe 32 PID 2000 wrote to memory of 3008 2000 LSASS.exe 32 PID 2000 wrote to memory of 3008 2000 LSASS.exe 32 PID 2000 wrote to memory of 3008 2000 LSASS.exe 32 PID 2000 wrote to memory of 2872 2000 LSASS.exe 35 PID 2000 wrote to memory of 2872 2000 LSASS.exe 35 PID 2000 wrote to memory of 2872 2000 LSASS.exe 35 PID 2000 wrote to memory of 2872 2000 LSASS.exe 35 PID 2000 wrote to memory of 2092 2000 LSASS.exe 36 PID 2000 wrote to memory of 2092 2000 LSASS.exe 36 PID 2000 wrote to memory of 2092 2000 LSASS.exe 36 PID 2000 wrote to memory of 2092 2000 LSASS.exe 36 PID 2000 wrote to memory of 2568 2000 LSASS.exe 37 PID 2000 wrote to memory of 2568 2000 LSASS.exe 37 PID 2000 wrote to memory of 2568 2000 LSASS.exe 37 PID 2000 wrote to memory of 2568 2000 LSASS.exe 37 PID 2000 wrote to memory of 2460 2000 LSASS.exe 40 PID 2000 wrote to memory of 2460 2000 LSASS.exe 40 PID 2000 wrote to memory of 2460 2000 LSASS.exe 40 PID 2000 wrote to memory of 2460 2000 LSASS.exe 40 PID 2000 wrote to memory of 2464 2000 LSASS.exe 41 PID 2000 wrote to memory of 2464 2000 LSASS.exe 41 PID 2000 wrote to memory of 2464 2000 LSASS.exe 41 PID 2000 wrote to memory of 2464 2000 LSASS.exe 41 PID 2000 wrote to memory of 2068 2000 LSASS.exe 44 PID 2000 wrote to memory of 2068 2000 LSASS.exe 44 PID 2000 wrote to memory of 2068 2000 LSASS.exe 44 PID 2000 wrote to memory of 2068 2000 LSASS.exe 44 PID 2000 wrote to memory of 2064 2000 LSASS.exe 45 PID 2000 wrote to memory of 2064 2000 LSASS.exe 45 PID 2000 wrote to memory of 2064 2000 LSASS.exe 45 PID 2000 wrote to memory of 2064 2000 LSASS.exe 45 PID 2000 wrote to memory of 2948 2000 LSASS.exe 48 PID 2000 wrote to memory of 2948 2000 LSASS.exe 48 PID 2000 wrote to memory of 2948 2000 LSASS.exe 48 PID 2000 wrote to memory of 2948 2000 LSASS.exe 48 PID 2000 wrote to memory of 2524 2000 LSASS.exe 50 PID 2000 wrote to memory of 2524 2000 LSASS.exe 50 PID 2000 wrote to memory of 2524 2000 LSASS.exe 50 PID 2000 wrote to memory of 2524 2000 LSASS.exe 50 PID 2000 wrote to memory of 2888 2000 LSASS.exe 52 PID 2000 wrote to memory of 2888 2000 LSASS.exe 52 PID 2000 wrote to memory of 2888 2000 LSASS.exe 52 PID 2000 wrote to memory of 2888 2000 LSASS.exe 52 PID 2000 wrote to memory of 2012 2000 LSASS.exe 53 PID 2000 wrote to memory of 2012 2000 LSASS.exe 53 PID 2000 wrote to memory of 2012 2000 LSASS.exe 53 PID 2000 wrote to memory of 2012 2000 LSASS.exe 53 PID 2000 wrote to memory of 2556 2000 LSASS.exe 56 PID 2000 wrote to memory of 2556 2000 LSASS.exe 56 PID 2000 wrote to memory of 2556 2000 LSASS.exe 56 PID 2000 wrote to memory of 2556 2000 LSASS.exe 56 PID 2000 wrote to memory of 536 2000 LSASS.exe 57 PID 2000 wrote to memory of 536 2000 LSASS.exe 57 PID 2000 wrote to memory of 536 2000 LSASS.exe 57 PID 2000 wrote to memory of 536 2000 LSASS.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe"C:\Users\Admin\AppData\Local\Temp\d230ef90b153f8c9f6cb1085fa134a44922f78f1a4e95eeb7c73d3651adaa52b.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\LSASS.exe"C:\Windows\LSASS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3008
-
-
C:\Users\Admin\LSASS.exe"C:\Users\Admin\LSASS.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2872
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2568
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2460
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2948
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2544
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:924
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1020
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3064
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1668
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1904
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2284
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2464
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1924
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1796
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1144
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2888
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2060
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2056
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:560
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1416
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1864
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1884
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1712
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1588
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1688
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Windows\SysWOW64\REG.exeREG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v SysUtils /t REG_SZ /d "C:\Windows\LSASS.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3032
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD59c6841dcfb39beef8f42f8f6ceedad91
SHA1fa0dd37d2866357ace516e7d3a4369bfda3fcd70
SHA256d5cff418dedf6cd427c1ac2b02cf6f2fd6ea5f2d654bb9ef36622e977db4789b
SHA51247f891cea31351c83061b3336a1f5066ad10281a0e08230026ce4441255f32edc8a4fc574c497c523abee4def266546c9acd87595e7ea4426e70647a7b4fc955
-
Filesize
190B
MD5b1445c7f646c6ca9a7597791af38d575
SHA191efaf63fa1f7a51ee2f9b1c3b0f8932f15439ce
SHA256220517d50470c86d94020cebcd03af286898e65338f468dc5f860dc04af2c88e
SHA512533349278b6d186f0f3947681e90dcc7f617e146736798e6fc23e79d61610f1f7b2e4b4241b296884622fbd6b1cf73dc694a852e05bf4235da8ed40b70c5683f
-
Filesize
455KB
MD59e4faa45d86e4ab10c60edc6ed855e8f
SHA16ca81009f953b54a6f22fc858a6d0ce5b3fb452d
SHA2565cc70c83a654c746a14459af74a0c35c1579492e92b76d5d42ef636a4ad9e856
SHA512fb85ae92f924bc39bedf7002f308c31517df52cd16802b41290122e64b5c8b437f27815d738388fe82653c2c5e3945475b6af8fd10cbb90999592b4abd02290e