Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/02/2025, 05:20
250208-f1rj5sypcl 10Analysis
-
max time kernel
170s -
max time network
171s -
platform
windows11-21h2_x64 -
resource
win11-20250207-en -
resource tags
arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/02/2025, 05:20
Static task
static1
General
-
Target
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___7AJ0FIA_.txt
cerber
http://xpcx6erilkjced3j.onion/2D37-0DD0-A9EC-0098-B912
http://xpcx6erilkjced3j.1n5mod.top/2D37-0DD0-A9EC-0098-B912
http://xpcx6erilkjced3j.19kdeh.top/2D37-0DD0-A9EC-0098-B912
http://xpcx6erilkjced3j.1mpsnr.top/2D37-0DD0-A9EC-0098-B912
http://xpcx6erilkjced3j.18ey8e.top/2D37-0DD0-A9EC-0098-B912
http://xpcx6erilkjced3j.17gcun.top/2D37-0DD0-A9EC-0098-B912
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file 1 IoCs
flow pid Process 2322 1952 Process not Found -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3492 netsh.exe 2556 netsh.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ [email protected] -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: [email protected] File opened (read-only) \??\i: [email protected] File opened (read-only) \??\j: [email protected] File opened (read-only) \??\k: [email protected] File opened (read-only) \??\r: [email protected] File opened (read-only) \??\t: [email protected] File opened (read-only) \??\v: [email protected] File opened (read-only) \??\y: [email protected] File opened (read-only) \??\b: [email protected] File opened (read-only) \??\h: [email protected] File opened (read-only) \??\o: [email protected] File opened (read-only) \??\q: [email protected] File opened (read-only) \??\w: [email protected] File opened (read-only) \??\a: [email protected] File opened (read-only) \??\e: [email protected] File opened (read-only) \??\l: [email protected] File opened (read-only) \??\m: [email protected] File opened (read-only) \??\s: [email protected] File opened (read-only) \??\g: [email protected] File opened (read-only) \??\n: [email protected] File opened (read-only) \??\p: [email protected] File opened (read-only) \??\u: [email protected] File opened (read-only) \??\x: [email protected] -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! [email protected] -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF1E2.bmp" [email protected] -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\program files (x86)\microsoft\word [email protected] File opened for modification \??\c:\program files (x86)\steam [email protected] File opened for modification \??\c:\program files (x86)\outlook [email protected] File opened for modification \??\c:\program files (x86)\word [email protected] File opened for modification \??\c:\program files\ [email protected] File opened for modification \??\c:\program files (x86)\ [email protected] File opened for modification \??\c:\program files (x86)\excel [email protected] File opened for modification \??\c:\program files (x86)\microsoft\onenote [email protected] File opened for modification \??\c:\program files (x86)\microsoft\outlook [email protected] File opened for modification \??\c:\program files (x86)\microsoft\excel [email protected] File opened for modification \??\c:\program files (x86)\microsoft\office [email protected] File opened for modification \??\c:\program files (x86)\microsoft\powerpoint [email protected] File opened for modification \??\c:\program files (x86)\onenote [email protected] File opened for modification \??\c:\program files (x86)\the bat! [email protected] File opened for modification \??\c:\program files (x86)\bitcoin [email protected] File opened for modification \??\c:\program files (x86)\microsoft sql server [email protected] File opened for modification \??\c:\program files (x86)\office [email protected] File opened for modification \??\c:\program files (x86)\powerpoint [email protected] File opened for modification \??\c:\program files (x86)\thunderbird [email protected] -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop [email protected] File opened for modification \??\c:\windows\ [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1668 cmd.exe 660 PING.EXE 4100 MicrosoftEdgeUpdate.exe -
Kills process with taskkill 1 IoCs
pid Process 3700 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969674418-3952479498-2422112087-1000_Classes\Local Settings [email protected] -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 712 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 660 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3328 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3328 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 3584 [email protected] Token: SeCreatePagefilePrivilege 3584 [email protected] Token: SeDebugPrivilege 3700 taskkill.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe 3328 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3328 vlc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3492 3584 [email protected] 82 PID 3584 wrote to memory of 3492 3584 [email protected] 82 PID 3584 wrote to memory of 3492 3584 [email protected] 82 PID 3584 wrote to memory of 2556 3584 [email protected] 84 PID 3584 wrote to memory of 2556 3584 [email protected] 84 PID 3584 wrote to memory of 2556 3584 [email protected] 84 PID 3584 wrote to memory of 3028 3584 [email protected] 88 PID 3584 wrote to memory of 3028 3584 [email protected] 88 PID 3584 wrote to memory of 3028 3584 [email protected] 88 PID 3584 wrote to memory of 712 3584 [email protected] 89 PID 3584 wrote to memory of 712 3584 [email protected] 89 PID 3584 wrote to memory of 712 3584 [email protected] 89 PID 3584 wrote to memory of 1668 3584 [email protected] 90 PID 3584 wrote to memory of 1668 3584 [email protected] 90 PID 3584 wrote to memory of 1668 3584 [email protected] 90 PID 1668 wrote to memory of 3700 1668 cmd.exe 92 PID 1668 wrote to memory of 3700 1668 cmd.exe 92 PID 1668 wrote to memory of 3700 1668 cmd.exe 92 PID 1668 wrote to memory of 660 1668 cmd.exe 94 PID 1668 wrote to memory of 660 1668 cmd.exe 94 PID 1668 wrote to memory of 660 1668 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3492
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___L6GG40ZA_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:3028
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___6B8Z_.txt2⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:712
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "E"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:660
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDJEMTRBQUYtNENBMC00RUFELUI4RkMtQTZDNjkxMDE4Mzc3fSIgdXNlcmlkPSJ7OTdEMDFFQTgtOTAzNi00MkE1LTg3MTMtQTBGQTg2MTlDQ0RGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QUFDNUQ5QjctQTREQi00QkJDLUFDNTktNDg1OUEzMzZDMEFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1NTk3NyIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI4NTM1NTkwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNjMwMzkyMDMiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4100
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___L6GG40ZA_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
PID:804
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:336
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SetTest.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3328
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___L6GG40ZA_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
PID:4960
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Discovery
Network Service Discovery
1Peripheral Device Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD568cd111a4bb7b4f7d90e85c7631a109f
SHA1d98de6c380e6cb706bdeb995e109c11d3a1af173
SHA2564d46842ea96a8a05645e0f1a7c3dd2d3939d60b57da643301d571b7fb3f7f762
SHA5123092ff9fc73fdee323f30b69569854492cb8798d288f29a3b05224f547f56bf5d113a4053339b08a59ebd137488bea0be6b2afb72d7f99e178c51a4d82cf3d56
-
Filesize
1KB
MD5d3fc8ddaab42d2d3014d5afa576f8159
SHA1ce08a037af670e5d2331730b80bd4bbe123fd96d
SHA256ad0f08b7570edbbf0948e48a360d8bdc27462ae3575d5f98cbec8c7c8d39f25c
SHA512062aff2f6c0581360dbd31be49bde0811baf9bb748db2026b8d55fe19e667ef8f40e5e3dd06e4c742abc68932c3a5cd4eaedad8895ac3cedcff0be4cab107edd