Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2025, 14:25 UTC

General

  • Target

    JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a.exe

  • Size

    121KB

  • MD5

    4bde8f0106a634f5db438cec9dd17b6a

  • SHA1

    e198af6e680729e5d0703b3ce9270eab50ce9cad

  • SHA256

    d1ca348a5190346a4ea5899a85754ffbeb832900edc5f26dddcc04cb6fe21d8a

  • SHA512

    2d4b9d2490666b2ab5a6b474fb0e9fd6851a0ce77c3e79f2bf1f49d47ef2fc36da354318f9613de828b0ffe73fe04ce718286903b1eb8784ee979fe0e58da1cb

  • SSDEEP

    3072:bssmJjFCzCQZxJX7Zvwz/flgnL4pi+t5AJT+2X2G:4zWzzZxHQOL47Adn

Malware Config

Signatures

  • Detect XtremeRAT payload 7 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 32 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 32 IoCs
  • Drops file in System32 directory 29 IoCs
  • Suspicious use of SetThreadContext 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:1748
        • C:\Windows\SysWOW64\windows1\window.exe
          "C:\Windows\system32\windows1\window.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2504
          • C:\Windows\SysWOW64\windows1\window.exe
            C:\Windows\SysWOW64\windows1\window.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            PID:2884
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              6⤵
                PID:836
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                6⤵
                  PID:2444
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  6⤵
                    PID:1924
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe"
                    6⤵
                      PID:2024
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe"
                      6⤵
                        PID:1908
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe"
                        6⤵
                          PID:2404
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe"
                          6⤵
                            PID:1424
                          • C:\Program Files\Internet Explorer\iexplore.exe
                            "C:\Program Files\Internet Explorer\iexplore.exe"
                            6⤵
                              PID:1984
                            • C:\Windows\SysWOW64\windows1\window.exe
                              "C:\Windows\SysWOW64\windows1\window.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:1036
                              • C:\Windows\SysWOW64\windows1\window.exe
                                C:\Windows\SysWOW64\windows1\window.exe
                                7⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                PID:2308
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                  8⤵
                                    PID:2864
                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                    8⤵
                                      PID:2124
                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                      8⤵
                                        PID:1080
                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                        8⤵
                                          PID:1264
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                          8⤵
                                            PID:1712
                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                            8⤵
                                              PID:1328
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                              8⤵
                                                PID:3024
                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                8⤵
                                                  PID:2120
                                                • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                  "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2972
                                                  • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                    C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                    9⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1540
                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                      10⤵
                                                        PID:2200
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                        10⤵
                                                          PID:2080
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                          10⤵
                                                            PID:2112
                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                            10⤵
                                                              PID:3048
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                              10⤵
                                                                PID:2608
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                10⤵
                                                                  PID:2492
                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                  10⤵
                                                                    PID:2616
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                    10⤵
                                                                      PID:1876
                                                                    • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                      "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                      10⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1904
                                                                      • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                        C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                        11⤵
                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2020
                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                          12⤵
                                                                            PID:1288
                                                          • C:\Windows\SysWOW64\windows1\window.exe
                                                            "C:\Windows\system32\windows1\window.exe"
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2784
                                                            • C:\Windows\SysWOW64\windows1\window.exe
                                                              C:\Windows\SysWOW64\windows1\window.exe
                                                              5⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Adds Run key to start application
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2128
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                6⤵
                                                                  PID:796
                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                  6⤵
                                                                    PID:1840
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                    6⤵
                                                                      PID:440
                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                      6⤵
                                                                        PID:1768
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                        6⤵
                                                                          PID:1764
                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                          6⤵
                                                                            PID:1800
                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                            6⤵
                                                                              PID:1116
                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                              6⤵
                                                                                PID:2008
                                                                              • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2196
                                                                                • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                  C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                  7⤵
                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1584
                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                    8⤵
                                                                                      PID:1728
                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      8⤵
                                                                                        PID:2368
                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                        8⤵
                                                                                          PID:1656
                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                          8⤵
                                                                                            PID:2736
                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                            8⤵
                                                                                              PID:2808
                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                              8⤵
                                                                                                PID:2728
                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                8⤵
                                                                                                  PID:2264
                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                  8⤵
                                                                                                    PID:2040
                                                                                                  • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                                                    8⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2528
                                                                                                    • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                      9⤵
                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:1420
                                                                                          • C:\Windows\SysWOW64\windows1\window.exe
                                                                                            "C:\Windows\system32\windows1\window.exe"
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2156
                                                                                            • C:\Windows\SysWOW64\windows1\window.exe
                                                                                              C:\Windows\SysWOW64\windows1\window.exe
                                                                                              5⤵
                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2796
                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                6⤵
                                                                                                  PID:2268
                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                  6⤵
                                                                                                    PID:1612
                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                    6⤵
                                                                                                      PID:2624
                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                      6⤵
                                                                                                        PID:2644
                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                        6⤵
                                                                                                          PID:2440
                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                          6⤵
                                                                                                            PID:2520
                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                            6⤵
                                                                                                              PID:2192
                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                              6⤵
                                                                                                                PID:1940
                                                                                                              • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                "C:\Windows\SysWOW64\windows1\window.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2400
                                                                                                                • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                  C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                  7⤵
                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1592
                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                    8⤵
                                                                                                                      PID:2784
                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                            3⤵
                                                                                                              PID:2848
                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                              3⤵
                                                                                                                PID:2792
                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                3⤵
                                                                                                                  PID:2568
                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                  3⤵
                                                                                                                    PID:2052
                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                    3⤵
                                                                                                                      PID:2176
                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                      3⤵
                                                                                                                        PID:304
                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                        3⤵
                                                                                                                          PID:2292
                                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                          3⤵
                                                                                                                            PID:2296
                                                                                                                          • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                            "C:\Windows\system32\windows1\window.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2084
                                                                                                                            • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                              C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                              4⤵
                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2340
                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:2960
                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:2984
                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:2632
                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:2708
                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:2712
                                                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:2752
                                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:2816
                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:2640
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:2700
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                  6⤵
                                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1392
                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                    7⤵
                                                                                                                                                      PID:2596
                                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:3060
                                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:572
                                                                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:1028
                                                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:2428
                                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:1744
                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:1780
                                                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:2420
                                                                                                                                                                  • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                                                                    "C:\Windows\system32\windows1\window.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:2452
                                                                                                                                                                    • C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                                                                      C:\Windows\SysWOW64\windows1\window.exe
                                                                                                                                                                      8⤵
                                                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2224
                                                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                        9⤵
                                                                                                                                                                          PID:1056
                                                                                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:1948
                                                                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:1300
                                                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:1632
                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:2456
                                                                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:532
                                                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:1720
                                                                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                      9⤵
                                                                                                                                                                                        PID:1272
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                                                                                                                                        9⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:680
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                          10⤵
                                                                                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2584
                                                                                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                            11⤵
                                                                                                                                                                                              PID:3040
                                                                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:2856
                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:1604
                                                                                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                    PID:2664
                                                                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:2660
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\windows1\window.exe"
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\windows1\window.exe
                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2652
                                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                    PID:1064

                                                                                                                                                                                          Network

                                                                                                                                                                                          • flag-us
                                                                                                                                                                                            DNS
                                                                                                                                                                                            maom.no-ip.org
                                                                                                                                                                                            window.exe
                                                                                                                                                                                            Remote address:
                                                                                                                                                                                            8.8.8.8:53
                                                                                                                                                                                            Request
                                                                                                                                                                                            maom.no-ip.org
                                                                                                                                                                                            IN A
                                                                                                                                                                                            Response
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 127.0.0.1:81
                                                                                                                                                                                            window.exe
                                                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                                                            maom.no-ip.org
                                                                                                                                                                                            dns
                                                                                                                                                                                            window.exe
                                                                                                                                                                                            60 B
                                                                                                                                                                                            120 B
                                                                                                                                                                                            1
                                                                                                                                                                                            1

                                                                                                                                                                                            DNS Request

                                                                                                                                                                                            maom.no-ip.org

                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\6H@YU%FcS.cfg

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            ae35f7ae1b8140d689707f10742dbe9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a9a3ea242e822a4f92a9ec5bb1ae650e9e814b8c

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            668c50c3d2fddc20b41826a2075145b05fa6d7c348fadf57f63372a56fd99c27

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9eb9f784f4406f0774fd60da9d840e9a2cc99727f658f4cd08a40c49cb1b4ffb1f961d34fbc5a83887be7b01fb57c50f0e8367470e27b93c55f7919cabe131cf

                                                                                                                                                                                          • C:\Windows\SysWOW64\windows1\window.exe

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            121KB

                                                                                                                                                                                            MD5

                                                                                                                                                                                            4bde8f0106a634f5db438cec9dd17b6a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            e198af6e680729e5d0703b3ce9270eab50ce9cad

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d1ca348a5190346a4ea5899a85754ffbeb832900edc5f26dddcc04cb6fe21d8a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            2d4b9d2490666b2ab5a6b474fb0e9fd6851a0ce77c3e79f2bf1f49d47ef2fc36da354318f9613de828b0ffe73fe04ce718286903b1eb8784ee979fe0e58da1cb

                                                                                                                                                                                          • memory/680-123-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/680-130-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/1036-97-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/1036-91-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/1420-206-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/1748-14-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/1748-16-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/1748-61-0x0000000002A50000-0x0000000002AD6000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/1904-179-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2000-22-0x00000000035B0000-0x0000000003636000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2000-21-0x00000000035B0000-0x0000000003636000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2000-24-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/2000-8-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/2000-4-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/2000-5-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/2000-3-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            72KB

                                                                                                                                                                                          • memory/2084-23-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2084-31-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2156-164-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2196-150-0x0000000077220000-0x000000007733F000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/2196-151-0x0000000077120000-0x000000007721A000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1000KB

                                                                                                                                                                                          • memory/2196-152-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2400-201-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2452-78-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2452-82-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2504-67-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2508-173-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2528-190-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2528-199-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2700-51-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2784-114-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2900-0-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2900-7-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2972-142-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          • memory/2972-135-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                                                                                                                                            Filesize

                                                                                                                                                                                            536KB

                                                                                                                                                                                          We care about your privacy.

                                                                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.