Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2025, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe
Resource
win10v2004-20250129-en
General
-
Target
dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe
-
Size
3.6MB
-
MD5
89ba5e9d24155628896c522b926506d1
-
SHA1
b87e119f7bd9e421b8fa7c3666ae0921287231fb
-
SHA256
dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c
-
SHA512
6c023b78473e0689690825d3a50eb96aded1307a66e2082c127000574d8819642ba927763016b38b9a3cb5a6e6c27c2abe8205a742db20d6ab8e2ac833a28361
-
SSDEEP
98304:0rhw8VTDKJjizmvxgWHAfbCai0bZG5h3N10zpKVraQ:0lwceizmvxgWHAfg
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/4260-186-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-185-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-188-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-189-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-191-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-190-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-192-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-193-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4260-194-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4880 powershell.exe 2124 powershell.exe 3164 powershell.exe 3488 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 1 IoCs
flow pid Process 10 2156 loader.exe -
Stops running service(s) 4 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\International\Geo\Nation runhost.exe -
Executes dropped EXE 14 IoCs
pid Process 2156 loader.exe 2904 Xeno.exe 5000 runhost.exe 3496 7z.exe 3900 7z.exe 1644 7z.exe 3884 7z.exe 4532 7z.exe 8 7z.exe 1124 7z.exe 1040 7z.exe 3912 7z.exe 4940 svchosts64.exe 2640 akeukanvzwhg.exe -
Loads dropped DLL 13 IoCs
pid Process 2156 loader.exe 2156 loader.exe 2156 loader.exe 2156 loader.exe 3496 7z.exe 3900 7z.exe 1644 7z.exe 3884 7z.exe 4532 7z.exe 8 7z.exe 1124 7z.exe 1040 7z.exe 3912 7z.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 8 raw.githubusercontent.com 10 raw.githubusercontent.com 21 pastebin.com 22 pastebin.com -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4868 powercfg.exe 1872 powercfg.exe 624 powercfg.exe 620 powercfg.exe 5072 powercfg.exe 1448 powercfg.exe 1788 powercfg.exe 1884 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe svchosts64.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe akeukanvzwhg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2640 set thread context of 3692 2640 akeukanvzwhg.exe 160 PID 2640 set thread context of 4260 2640 akeukanvzwhg.exe 165 -
resource yara_rule behavioral2/memory/4260-186-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-185-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-188-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-189-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-191-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-190-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-183-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-182-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-184-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-180-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-181-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-192-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-193-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4260-194-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1440 sc.exe 4244 sc.exe 1344 sc.exe 4584 sc.exe 464 sc.exe 1940 sc.exe 4964 sc.exe 792 sc.exe 2892 sc.exe 452 sc.exe 1736 sc.exe 4620 sc.exe 2496 sc.exe 4736 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runhost.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 powershell.exe 4880 powershell.exe 2124 powershell.exe 2124 powershell.exe 4940 svchosts64.exe 3164 powershell.exe 3164 powershell.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 4940 svchosts64.exe 2640 akeukanvzwhg.exe 3488 powershell.exe 3488 powershell.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 2640 akeukanvzwhg.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe 4260 explorer.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeRestorePrivilege 3496 7z.exe Token: 35 3496 7z.exe Token: SeSecurityPrivilege 3496 7z.exe Token: SeSecurityPrivilege 3496 7z.exe Token: SeRestorePrivilege 3900 7z.exe Token: 35 3900 7z.exe Token: SeSecurityPrivilege 3900 7z.exe Token: SeSecurityPrivilege 3900 7z.exe Token: SeRestorePrivilege 1644 7z.exe Token: 35 1644 7z.exe Token: SeSecurityPrivilege 1644 7z.exe Token: SeSecurityPrivilege 1644 7z.exe Token: SeRestorePrivilege 3884 7z.exe Token: 35 3884 7z.exe Token: SeSecurityPrivilege 3884 7z.exe Token: SeSecurityPrivilege 3884 7z.exe Token: SeRestorePrivilege 4532 7z.exe Token: 35 4532 7z.exe Token: SeSecurityPrivilege 4532 7z.exe Token: SeSecurityPrivilege 4532 7z.exe Token: SeRestorePrivilege 8 7z.exe Token: 35 8 7z.exe Token: SeSecurityPrivilege 8 7z.exe Token: SeSecurityPrivilege 8 7z.exe Token: SeRestorePrivilege 1124 7z.exe Token: 35 1124 7z.exe Token: SeSecurityPrivilege 1124 7z.exe Token: SeSecurityPrivilege 1124 7z.exe Token: SeRestorePrivilege 1040 7z.exe Token: 35 1040 7z.exe Token: SeSecurityPrivilege 1040 7z.exe Token: SeSecurityPrivilege 1040 7z.exe Token: SeRestorePrivilege 3912 7z.exe Token: 35 3912 7z.exe Token: SeSecurityPrivilege 3912 7z.exe Token: SeSecurityPrivilege 3912 7z.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeShutdownPrivilege 1448 powercfg.exe Token: SeCreatePagefilePrivilege 1448 powercfg.exe Token: SeShutdownPrivilege 620 powercfg.exe Token: SeCreatePagefilePrivilege 620 powercfg.exe Token: SeShutdownPrivilege 5072 powercfg.exe Token: SeCreatePagefilePrivilege 5072 powercfg.exe Token: SeShutdownPrivilege 1788 powercfg.exe Token: SeCreatePagefilePrivilege 1788 powercfg.exe Token: SeDebugPrivilege 3488 powershell.exe Token: SeShutdownPrivilege 1884 powercfg.exe Token: SeCreatePagefilePrivilege 1884 powercfg.exe Token: SeShutdownPrivilege 1872 powercfg.exe Token: SeCreatePagefilePrivilege 1872 powercfg.exe Token: SeLockMemoryPrivilege 4260 explorer.exe Token: SeShutdownPrivilege 624 powercfg.exe Token: SeCreatePagefilePrivilege 624 powercfg.exe Token: SeShutdownPrivilege 4868 powercfg.exe Token: SeCreatePagefilePrivilege 4868 powercfg.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1344 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 84 PID 4004 wrote to memory of 1344 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 84 PID 1344 wrote to memory of 4880 1344 cmd.exe 85 PID 1344 wrote to memory of 4880 1344 cmd.exe 85 PID 4004 wrote to memory of 2744 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 88 PID 4004 wrote to memory of 2744 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 88 PID 2744 wrote to memory of 2124 2744 cmd.exe 89 PID 2744 wrote to memory of 2124 2744 cmd.exe 89 PID 4004 wrote to memory of 2156 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 91 PID 4004 wrote to memory of 2156 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 91 PID 4004 wrote to memory of 2904 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 93 PID 4004 wrote to memory of 2904 4004 dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe 93 PID 2156 wrote to memory of 5000 2156 loader.exe 94 PID 2156 wrote to memory of 5000 2156 loader.exe 94 PID 2156 wrote to memory of 5000 2156 loader.exe 94 PID 5000 wrote to memory of 180 5000 runhost.exe 95 PID 5000 wrote to memory of 180 5000 runhost.exe 95 PID 180 wrote to memory of 4400 180 cmd.exe 97 PID 180 wrote to memory of 4400 180 cmd.exe 97 PID 180 wrote to memory of 3496 180 cmd.exe 98 PID 180 wrote to memory of 3496 180 cmd.exe 98 PID 180 wrote to memory of 3900 180 cmd.exe 99 PID 180 wrote to memory of 3900 180 cmd.exe 99 PID 180 wrote to memory of 1644 180 cmd.exe 100 PID 180 wrote to memory of 1644 180 cmd.exe 100 PID 180 wrote to memory of 3884 180 cmd.exe 101 PID 180 wrote to memory of 3884 180 cmd.exe 101 PID 180 wrote to memory of 4532 180 cmd.exe 102 PID 180 wrote to memory of 4532 180 cmd.exe 102 PID 180 wrote to memory of 8 180 cmd.exe 103 PID 180 wrote to memory of 8 180 cmd.exe 103 PID 180 wrote to memory of 1124 180 cmd.exe 104 PID 180 wrote to memory of 1124 180 cmd.exe 104 PID 180 wrote to memory of 1040 180 cmd.exe 105 PID 180 wrote to memory of 1040 180 cmd.exe 105 PID 180 wrote to memory of 3912 180 cmd.exe 106 PID 180 wrote to memory of 3912 180 cmd.exe 106 PID 180 wrote to memory of 4328 180 cmd.exe 107 PID 180 wrote to memory of 4328 180 cmd.exe 107 PID 180 wrote to memory of 4940 180 cmd.exe 108 PID 180 wrote to memory of 4940 180 cmd.exe 108 PID 3528 wrote to memory of 3792 3528 cmd.exe 116 PID 3528 wrote to memory of 3792 3528 cmd.exe 116 PID 4664 wrote to memory of 3676 4664 cmd.exe 147 PID 4664 wrote to memory of 3676 4664 cmd.exe 147 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 3692 2640 akeukanvzwhg.exe 160 PID 2640 wrote to memory of 4260 2640 akeukanvzwhg.exe 165 PID 2640 wrote to memory of 4260 2640 akeukanvzwhg.exe 165 PID 2640 wrote to memory of 4260 2640 akeukanvzwhg.exe 165 PID 2640 wrote to memory of 4260 2640 akeukanvzwhg.exe 165 PID 2640 wrote to memory of 4260 2640 akeukanvzwhg.exe 165 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4328 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe"C:\Users\Admin\AppData\Local\Temp\dd792996cc7a4240cbf2a275344a13a393d304736034fb09fe280372e34a107c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main'2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\main'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Programdata'2⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Programdata'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
-
C:\ProgramData\Tempsphere\loader.exe"C:\ProgramData\Tempsphere\loader.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\ProgramData\Tempsphere\runhost.exe"runhost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Suspicious use of WriteProcessMemory
PID:180 -
C:\Windows\system32\mode.commode 65,105⤵PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p116401457132732233221366211788 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_8.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\system32\attrib.exeattrib +H "svchosts64.exe"5⤵
- Views/modifies file attributes
PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\main\svchosts64.exe"svchosts64.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4940 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵PID:3792
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
PID:4620
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
PID:2892
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
PID:4964
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
PID:792
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "MRDNTHEZ"6⤵
- Launches sc.exe
PID:4244
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "MRDNTHEZ" binpath= "C:\ProgramData\pfxskvlrwymw\akeukanvzwhg.exe" start= "auto"6⤵
- Launches sc.exe
PID:1344
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
PID:1440
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "MRDNTHEZ"6⤵
- Launches sc.exe
PID:2496
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"2⤵
- Executes dropped EXE
PID:2904
-
-
C:\ProgramData\pfxskvlrwymw\akeukanvzwhg.exeC:\ProgramData\pfxskvlrwymw\akeukanvzwhg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3676
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4584
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:464
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:452
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:4736
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1736
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:3692
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD5c82ec4147225a3265c65feb328b05e72
SHA13e4c30fce1f858ed7656ac46ef878733bb9ad9f1
SHA25618ced2beab443eb8a57ef2bb04df34100e32deb34049ddd82ee9cc329a22fa7f
SHA5124b1d6c431ac70236b7b5e742d89edc57efbaf61b209f7d813ae546602b98a58258218ef51dda16638cf3b19721dd27a9d6c02943bd6984db18c043efffac628d
-
Filesize
214KB
MD592b4183563b3b9d42009806a79100396
SHA16882722eda6cb8c0255595488936dfdedc53f787
SHA256958686bc633c06538ab233791ed5fd9dc45d7d3de6739487f1cb4acec950d460
SHA512fd61c9bed17020f9326d32be99d8c143b2cac264f75e1031e93ce5d691bf1fb4c1c87e60127081b86b542fbd8768f4859baaf4ede6337e2dca9e0fc75840f7d0
-
Filesize
6.5MB
MD537f7c3155de3dfe24058e5c2fbb02457
SHA15473c15e4a452cdfaf367896767552b293fc1128
SHA256342ed8a02a7d5b6e2bdbac703c670f1817c9f16651e91bcef401210e8d003861
SHA5126ec9f4d81771ba523a63af11d835f83f7c441ccc6d3961e3825463fe03aa71d4704bce50d46e338da6548794872c2aeb7699c2d52d0b14760fef4c24c8a3f95f
-
Filesize
86KB
MD5c2bbcb5aae069c22711d8e49d6107401
SHA1475944ffa91d04fc2ef99de22755e46c09b66ac5
SHA25662713886db7fd51b3a1fdcf3a72596b85922fc86fc2128dd72b0ed6fcc8315ab
SHA51215ba28f3ea593c002197c3bac2523d2f7869945364b135995e53620dd85e99e480a10d74cdce4422304db3fb1d02d2e1903c78ecf6c6cb47afe6a10857493c30
-
Filesize
87KB
MD5e3181ce9d8e7fe239d612869d4e4afc3
SHA11c1057d6442da09059dd1741d3a595ebd577a140
SHA25688e31462b7d6cc43970a849c0e42205ab398a75bf4c6e78209af3dcf1ab2fe01
SHA512daeca18827df5145e20f826bdb0177934205ed4811a2b9a0288b395219196576d2d98f90bfe97c6593ae346cc86919988e6309d1fd88d8f117a6d280c2f04807
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD58e36164c76778c19637405adc15c138d
SHA15a84b55368cc3c58c628aef578b658fede2a27f4
SHA256bc9323059bc4e6793598b39d942be6720745037ded472e084f2b2b4b60d07f87
SHA512d2dade91b8654b52857af12addc756817910463d5cd366fe9a13d6b23c3f2024ee2603b094bc03815b5f0f28891142d914aa65950e8a073961a4a5a312c25ff4
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
140KB
MD5f0d6a8ef8299c5f15732a011d90b0be1
SHA15d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf
SHA256326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b
SHA5125b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
2.3MB
MD58d14f7a91aba7e003e317b6593999843
SHA182102a2fa3c69138d140318135d317468330fbaf
SHA256940b1339332da8fc54f1ca9d53560ac7737fd1ea815ab60d8ea999ce5da749ec
SHA51274d7240923a54f8b79c23751991791d1811edb9ed9e2a725e82b62de8f63ca444eefdb35d3e25f7ac06b785e58cc557feacbfea958c507b98cb890a0c4312cdb
-
Filesize
4.0MB
MD5e8516a55726347f63e0c6536d519613a
SHA1a28c7479d55bf3444d8015772ba82f47ef504e50
SHA256e2584c41f4c43a048172bb41b87961161a0b5992a94df9cbafb75d6cfc0e5d37
SHA5128f516087f043fdf38fccc8a80abad98af6ed24e85fd25fc5315beb5eb463263e21a33c7e078672b601e3bd61aab3eaf6c2f2396df3b037f4dcc318210a8e72e3
-
Filesize
4.0MB
MD5dd85a17419518363ef9893b8112b7fce
SHA14f15afd281bc855a53fe349537d607f069fbd278
SHA2563609072775830d7983f5c6471561a5ae3c0725439fdc1a491240ab00bb112657
SHA5129fbeef9bb2271d59dcc51811f9ab40c530accc9d948eb221bf37eac68e73233da96d9bf3d72e2ea912ca9e603ef665737335564d17df94d8c0ad8b5f3a4bcdde
-
Filesize
4.0MB
MD548dec71072f350526afcd05a8e381540
SHA1a7f9768d91cbd8dc949ce667f73f3f4644d27293
SHA256fc58dc8ef5037a9d586f1bd0b752de7faf639db1c1b864743b32e21689a07f58
SHA512b2c6f79845f14bd6eeb04c765e6d6e857f1232626cebc4aacf41294b753bfc71b1fb6d3054cf17c581126afe1e0f36ac2c7e1c6876b6132e4bdaa1fc8f82bd7e
-
Filesize
4.0MB
MD549fcf760542d4d38e9dfbd40a1f597b3
SHA1abc784eb0f9622680d3f016740edf30f5e4079dd
SHA2561ef7f93f21594f20e5503bd61f0e23669e5e1036445e7f783dfe2898b78e45a3
SHA5129b0e67296ff7920a6eb47e43055e411f8e9fe48b32c0494cbf597204638b045d87ea8360bc140ff276a316db72eadd700fa2f4cb0b30273fd3e5e56108e5bba0
-
Filesize
4.0MB
MD569fc58b80d3be792193c998eede77412
SHA12ac25d0c4f4a764da32fe4885b0211c0d7eb806e
SHA256066d64423179b9d04dfd7d734ecc3a6cdb64086033d53dfaf212be0979d5414c
SHA5129b7ea5dacfcd572acca86755c1a021bee6659f0035a74a4b8d09b34ef4c87133c1c63fbc84bfb9b16254102d4a2a8adaf028f76d04872feec0082c48115da7ce
-
Filesize
4.0MB
MD5a9fedb8bf08d56c089de16efd627adeb
SHA1f65903701f717c4566c62cdd9f85c96a0a1b9a62
SHA25604649ee54b85a8c2d1e0afaa68d4f7235bb7414f531bfdfdc6b66a5993e76d31
SHA5120590f441e8e4dc71e0483821f431e8ecaf4545fff35316655caa10b38de5cf9770d07a5f9c0a5386000efae976f7ed9f05173dbdc0923ebfd00d7b1d74bd8d90
-
Filesize
4.0MB
MD527b3cec95521dae2ff55823886efd19f
SHA1fc4a88861a2ee0b71c74706510b33e3ca79a2730
SHA256159730b4447b970a1fb6f149ea8c0a0fbbbef909b853bcec6d52b0f49b452023
SHA512fc855fbecd5786a32392f3209ac31a4d3917e73df26065d70b981a23f27dd189ca25fa966bcb18ca12b949ba0893821b4922b18580ca00848871a4709fd4ad25
-
Filesize
5.6MB
MD5a213e483224a94129d45a68cf87bf332
SHA1ce5c1a202d6980c13f0a1f77c020477ba7854a3f
SHA2565fab6f207605e692b5a9040d9ede241beb8bc8f2e4be18be5fd19e31e1f4d4e0
SHA512c3e35d810f509f5c0928ceec09439863f94742e9d0567d555ebd8dd74762dda6f7a3195fd7d7ea628a5e5c7bed636a627dc9c3a34d40d02b57f615cc65be84d3
-
Filesize
5.0MB
MD5269a52731eb2a65293b3c4e98da28b01
SHA1d867da5ec5672967fbfa83d2ceb1f7183dd09c63
SHA256a2b1b4454d3e8ef9442a0540130f8fe8fad3b7c162b98d168e566fc06fcbd5c2
SHA5125037f192d0857df4d523e6b3c0cab3c1b0c245fdd8ebf72ae52fc58af553953d53c5a47849491c45d9ec37ffa7daf39f4ab35f24cf770f55484100c293467566
-
Filesize
5.6MB
MD544798dd99b34d2cb61b18a5f33224a85
SHA17d53b6ec40b042a48e673389fb2e74adb8635dc8
SHA25628d06a3ed54fc128fcacc62edef2b58f6146127f268ecf2ab762027f492844ff
SHA512cb64dd445c86daf3da4cb8c0247fd38d1f2809fd2485c7eec6b430f30d46b47c2a00468f6b22953a6947eefb49b245bb69891114ef52c4a53730d3a33f5e8256
-
Filesize
481B
MD55cab8c883ee58fd6b3236f0aae42951e
SHA151c670c42706bd3cc14fea4aed2c9c29a4b5a31a
SHA2562ad7ff43d0aeae6cf231fee6c7c92059824261248dcce2263937e96c1b64ff5a
SHA512f796bab96cb0f884b39b9f8d671869232bca88744c342ad9ccfae50bb6f1d288765758feb963ce7eb7b99733032e697cb31312c98d8df636c351437341f7e98e