Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3099355d506...eb.exe
windows7-x64
10099355d506...eb.exe
windows10-2004-x64
1023d6f9a120...1e.exe
windows7-x64
823d6f9a120...1e.exe
windows10-2004-x64
83a9efda763...8a.exe
windows7-x64
103a9efda763...8a.exe
windows10-2004-x64
103b49b6c1cc...86.exe
windows7-x64
103b49b6c1cc...86.exe
windows10-2004-x64
104f8799e544...b7.exe
windows7-x64
104f8799e544...b7.exe
windows10-2004-x64
1051bd8c50dd...09.exe
windows7-x64
1051bd8c50dd...09.exe
windows10-2004-x64
1056b7b7798a...0e.exe
windows7-x64
1056b7b7798a...0e.exe
windows10-2004-x64
1057fb495954...9d.exe
windows7-x64
1057fb495954...9d.exe
windows10-2004-x64
105f278f8bde...cb.exe
windows7-x64
105f278f8bde...cb.exe
windows10-2004-x64
1066b157a3d4...e6.exe
windows7-x64
1066b157a3d4...e6.exe
windows10-2004-x64
106ec9f82a79...36.exe
windows7-x64
106ec9f82a79...36.exe
windows10-2004-x64
108d469fed80...33.exe
windows7-x64
108d469fed80...33.exe
windows10-2004-x64
10977e5ce44a...f1.exe
windows7-x64
10977e5ce44a...f1.exe
windows10-2004-x64
10a4865b2ed7...c6.exe
windows7-x64
10a4865b2ed7...c6.exe
windows10-2004-x64
10cbee3a2ab9...7f.exe
windows7-x64
10cbee3a2ab9...7f.exe
windows10-2004-x64
10cd3b81fbf9...1c.exe
windows7-x64
10cd3b81fbf9...1c.exe
windows10-2004-x64
10Resubmissions
12/03/2025, 21:32
250312-1dmynatxey 1011/03/2025, 16:10
250311-tmgdxaxnx4 1006/03/2025, 02:30
250306-cze8yav1az 10Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
099355d506f15966ba946cd6f58a72f6c02c73232349cf7f2d6af5641eed0ceb.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
099355d506f15966ba946cd6f58a72f6c02c73232349cf7f2d6af5641eed0ceb.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
23d6f9a120790d441377488f28c15f7ffc4df84c3fb5d05ce42f0bae5d75731e.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
23d6f9a120790d441377488f28c15f7ffc4df84c3fb5d05ce42f0bae5d75731e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
3a9efda763f017e1ca8237aa27f8659b081f62f42e11aa36b6e122f65caca48a.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3a9efda763f017e1ca8237aa27f8659b081f62f42e11aa36b6e122f65caca48a.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
3b49b6c1cc92bed7fb10ec3399c1f03449c5ab983a7d03f22bd83392b7a2dc86.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3b49b6c1cc92bed7fb10ec3399c1f03449c5ab983a7d03f22bd83392b7a2dc86.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
4f8799e5441c553ebbda342b6b06356a70dc432e5ac0434f4158146520b57ab7.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
51bd8c50dd5a58aa312bbcd0db0a1c297b929b8addb04cca5552a0ed1a79b209.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
56b7b7798a01e1bad522a375b7b096efeba0e118885b353b525b44471cdec90e.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
56b7b7798a01e1bad522a375b7b096efeba0e118885b353b525b44471cdec90e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
57fb4959548b3597ea3689167e496cdbb83d07afa9f0f3acb6a56987cd50099d.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
57fb4959548b3597ea3689167e496cdbb83d07afa9f0f3acb6a56987cd50099d.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral19
Sample
66b157a3d414b913b1a436edc71e8fc733c1f5457302fe9ca950a8b16d86b9e6.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
66b157a3d414b913b1a436edc71e8fc733c1f5457302fe9ca950a8b16d86b9e6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral21
Sample
6ec9f82a79152492b6a50a55dee43665e5205d607206573ce3729f824a05db36.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
6ec9f82a79152492b6a50a55dee43665e5205d607206573ce3729f824a05db36.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral23
Sample
8d469fed80fcd597d17e15df98cd15a4646abb69cd7f81795af94c2c46ed2a33.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
8d469fed80fcd597d17e15df98cd15a4646abb69cd7f81795af94c2c46ed2a33.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral25
Sample
977e5ce44a0ca0b374857f1f9ba476376ab41b7edf1117a3f5b805a69244f6f1.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
977e5ce44a0ca0b374857f1f9ba476376ab41b7edf1117a3f5b805a69244f6f1.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral27
Sample
a4865b2ed7dce154e50357674e8f15052a532609af0026dc4c8ea69b8a2f77c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
a4865b2ed7dce154e50357674e8f15052a532609af0026dc4c8ea69b8a2f77c6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral29
Sample
cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral31
Sample
cd3b81fbf93281530341f8c8cd66cfdeb7b2f1ec04f6fbe68ddcc35d28200a1c.exe
Resource
win7-20240903-en
General
-
Target
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
-
Size
659KB
-
MD5
183ebe37f8f5b5b3e324577327363c3f
-
SHA1
8ae40a52e750efa0f8c7014583770f9ff2343291
-
SHA256
5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb
-
SHA512
0b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034
-
SSDEEP
12288:X6jPyvD3aKx7bqyLZY7NsNAVSW/4zwHJeJ7zzwHJe:6sK4/qyLZoQAVSW/uwpeJDwpe
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
resource yara_rule behavioral17/memory/2668-17-0x0000000000400000-0x0000000000436000-memory.dmp family_snakekeylogger behavioral17/memory/2668-19-0x0000000000400000-0x0000000000436000-memory.dmp family_snakekeylogger behavioral17/memory/2668-21-0x0000000000400000-0x0000000000436000-memory.dmp family_snakekeylogger behavioral17/files/0x00050000000193fa-31.dat family_snakekeylogger behavioral17/memory/2560-36-0x00000000010B0000-0x00000000010D6000-memory.dmp family_snakekeylogger behavioral17/memory/1296-75-0x0000000000360000-0x0000000000386000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk FB_DEAC.tmp.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk FB_B7DA.tmp.exe -
Executes dropped EXE 6 IoCs
pid Process 1864 FB_DEAC.tmp.exe 2560 FB_DECC.tmp.exe 2576 sergf.exe 1536 sergf.exe 1784 FB_B7DA.tmp.exe 1296 FB_B839.tmp.exe -
Loads dropped DLL 14 IoCs
pid Process 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 1536 sergf.exe 1536 sergf.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_DEAC.tmp.exe\" .." FB_DEAC.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_B7DA.tmp.exe\" .." FB_B7DA.tmp.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 freegeoip.app 13 checkip.dyndns.org 17 freegeoip.app 4 checkip.dyndns.org 8 freegeoip.app -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2300 set thread context of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2576 set thread context of 1536 2576 sergf.exe 43 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 688 2560 WerFault.exe 38 2504 1296 WerFault.exe 50 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sergf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sergf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB_B839.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB_DECC.tmp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2012 schtasks.exe 1832 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2560 FB_DECC.tmp.exe 1296 FB_B839.tmp.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1784 FB_B7DA.tmp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe Token: SeDebugPrivilege 2560 FB_DECC.tmp.exe Token: SeDebugPrivilege 2576 sergf.exe Token: SeDebugPrivilege 1296 FB_B839.tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 2668 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 31 PID 2300 wrote to memory of 592 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 32 PID 2300 wrote to memory of 592 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 32 PID 2300 wrote to memory of 592 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 32 PID 2300 wrote to memory of 592 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 32 PID 2300 wrote to memory of 1488 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 34 PID 2300 wrote to memory of 1488 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 34 PID 2300 wrote to memory of 1488 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 34 PID 2300 wrote to memory of 1488 2300 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 34 PID 2668 wrote to memory of 1864 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 36 PID 2668 wrote to memory of 1864 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 36 PID 2668 wrote to memory of 1864 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 36 PID 2668 wrote to memory of 1864 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 36 PID 592 wrote to memory of 2012 592 cmd.exe 37 PID 592 wrote to memory of 2012 592 cmd.exe 37 PID 592 wrote to memory of 2012 592 cmd.exe 37 PID 592 wrote to memory of 2012 592 cmd.exe 37 PID 2668 wrote to memory of 2560 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 38 PID 2668 wrote to memory of 2560 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 38 PID 2668 wrote to memory of 2560 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 38 PID 2668 wrote to memory of 2560 2668 5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe 38 PID 2560 wrote to memory of 688 2560 FB_DECC.tmp.exe 40 PID 2560 wrote to memory of 688 2560 FB_DECC.tmp.exe 40 PID 2560 wrote to memory of 688 2560 FB_DECC.tmp.exe 40 PID 2560 wrote to memory of 688 2560 FB_DECC.tmp.exe 40 PID 1308 wrote to memory of 2576 1308 taskeng.exe 42 PID 1308 wrote to memory of 2576 1308 taskeng.exe 42 PID 1308 wrote to memory of 2576 1308 taskeng.exe 42 PID 1308 wrote to memory of 2576 1308 taskeng.exe 42 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 1536 2576 sergf.exe 43 PID 2576 wrote to memory of 2424 2576 sergf.exe 44 PID 2576 wrote to memory of 2424 2576 sergf.exe 44 PID 2576 wrote to memory of 2424 2576 sergf.exe 44 PID 2576 wrote to memory of 2424 2576 sergf.exe 44 PID 2576 wrote to memory of 1300 2576 sergf.exe 45 PID 2576 wrote to memory of 1300 2576 sergf.exe 45 PID 2576 wrote to memory of 1300 2576 sergf.exe 45 PID 2576 wrote to memory of 1300 2576 sergf.exe 45 PID 2424 wrote to memory of 1832 2424 cmd.exe 48 PID 2424 wrote to memory of 1832 2424 cmd.exe 48 PID 2424 wrote to memory of 1832 2424 cmd.exe 48 PID 2424 wrote to memory of 1832 2424 cmd.exe 48 PID 1536 wrote to memory of 1784 1536 sergf.exe 49 PID 1536 wrote to memory of 1784 1536 sergf.exe 49 PID 1536 wrote to memory of 1784 1536 sergf.exe 49 PID 1536 wrote to memory of 1784 1536 sergf.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\FB_DEAC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_DEAC.tmp.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\FB_DECC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_DECC.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 15804⤵
- Loads dropped DLL
- Program crash
PID:688
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1488
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F9A96A4D-F3E5-49F4-8D03-E947E6C3002E} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Roaming\sergf\sergf.exeC:\Users\Admin\AppData\Roaming\sergf\sergf.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\FB_B7DA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_B7DA.tmp.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: SetClipboardViewer
PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\FB_B839.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_B839.tmp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 15845⤵
- Loads dropped DLL
- Program crash
PID:2504
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1832
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1300
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5579984b39286dab555a977d62ecb1136
SHA161ed99c5548c9e4da6cb58d2b6f4092b465f736c
SHA2564d56991ab642d4473bbc416feb46029301f9d9598de3660743fdc9a202c407d0
SHA51257ec65b74fb2b743525ff6d78d8e2e75b8fc27abe80cf945fd69f24a374bfdc21435853707c66abf3b0711136d230dc11e3ba74d6ca788f8f9bfe9be55a967e4
-
Filesize
659KB
MD5183ebe37f8f5b5b3e324577327363c3f
SHA18ae40a52e750efa0f8c7014583770f9ff2343291
SHA2565f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb
SHA5120b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034
-
Filesize
69KB
MD50052d6c22b3c528c011b2e093155f8e0
SHA1e176827903acb3f96b4114b036a0cda8646331d9
SHA256eef635d1c6f58320072d6b4b762bee15d559978f2d150726a0fef3f83627871f
SHA512b6f1f20b43b2af9633d16532be2d05a1ece10d99a83481913b254a5301e0c7934a8035fc0ba752a5c863aea1828665ad99e69c8ccdaa086544f228beb72db50a
-
Filesize
126KB
MD56871e4e3ce2b458881aa007560ef80b5
SHA1e2a3fb4dc3d184693aed6b3c2f2f3065fdb0ff4e
SHA25639e83410a9e1b504499680e98c3a4c5b7f272bf74e72528c8796f97ef6868c6e
SHA5128bf95a29c79123bfd88f3ebbf1abd5095ce0bafac9cf9f97b619f4a1ab3e6df2574b9d24e9157b9da0d64240fa63818467ae31a0f2e139e411330a718371c7ef