Analysis
- max time kernel
150s - max time network
122s - platform
windows10_x64 - resource
win10v200430 - submitted
29/06/2020, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe
- Size 14.7MB
- Sample200629-xdck3vhtme
- SHA256 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15
- MD5 d0761a7482147cdace7c1f35cff81765
- SHA1 612c38f855cfdb9cca14d12a27961d17656070de
- SHA512 aeb3cceb066bd6580e81b06ea99fce73433bcd621a2774df606db1d6e64bd4a139f40f5f4b50b77a769ad76ec65545e681eeb3a0c1ac2972a0a89670fc5dc2b6
- MD5 SHA1 SHA512
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2080 wrote to memory of 420 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 66 PID 2080 wrote to memory of 420 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 66 PID 2080 wrote to memory of 420 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 66 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 2080 wrote to memory of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 504 wrote to memory of 1144 504 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 69 PID 504 wrote to memory of 1144 504 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 69 PID 504 wrote to memory of 1320 504 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 72 PID 504 wrote to memory of 1320 504 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 72 PID 504 wrote to memory of 1320 504 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 72 PID 1144 wrote to memory of 1920 1144 Esqyfk.exe 73 PID 1144 wrote to memory of 1920 1144 Esqyfk.exe 73 PID 1920 wrote to memory of 2876 1920 Esqyfk.exe 74 PID 1920 wrote to memory of 2876 1920 Esqyfk.exe 74 PID 1320 wrote to memory of 4044 1320 Cjoslavnmdd.exe 75 PID 1320 wrote to memory of 4044 1320 Cjoslavnmdd.exe 75 PID 1320 wrote to memory of 4044 1320 Cjoslavnmdd.exe 75 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 1320 wrote to memory of 3896 1320 Cjoslavnmdd.exe 77 PID 3896 wrote to memory of 852 3896 MSBuild.exe 80 PID 3896 wrote to memory of 852 3896 MSBuild.exe 80 PID 3896 wrote to memory of 852 3896 MSBuild.exe 80 PID 1320 wrote to memory of 2684 1320 Cjoslavnmdd.exe 82 PID 1320 wrote to memory of 2684 1320 Cjoslavnmdd.exe 82 PID 1320 wrote to memory of 2684 1320 Cjoslavnmdd.exe 82 PID 1320 wrote to memory of 2972 1320 Cjoslavnmdd.exe 83 PID 1320 wrote to memory of 2972 1320 Cjoslavnmdd.exe 83 PID 1320 wrote to memory of 2972 1320 Cjoslavnmdd.exe 83 PID 2972 wrote to memory of 2484 2972 cmd.exe 85 PID 2972 wrote to memory of 2484 2972 cmd.exe 85 PID 2972 wrote to memory of 2484 2972 cmd.exe 85 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2080 set thread context of 504 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 67 PID 1320 set thread context of 3896 1320 Cjoslavnmdd.exe 77 - Program crash 1 IoCs
pid pid_target Process procid_target 1316 2080 WerFault.exe 65 - Loads dropped DLL 14 IoCs
pid Process 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe 1920 Esqyfk.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2684 ctfmom.exe - Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
- Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 33 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: SeIncBasePriorityPrivilege 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe Token: 35 1920 Esqyfk.exe Token: SeRestorePrivilege 1316 WerFault.exe Token: SeBackupPrivilege 1316 WerFault.exe Token: SeDebugPrivilege 1316 WerFault.exe Token: SeDebugPrivilege 1320 Cjoslavnmdd.exe Token: SeDebugPrivilege 3896 MSBuild.exe - Suspicious behavior: EnumeratesProcesses 154 IoCs
pid Process 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 2080 260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1316 WerFault.exe 1320 Cjoslavnmdd.exe 1320 Cjoslavnmdd.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe 3896 MSBuild.exe - Executes dropped EXE 4 IoCs
pid Process 1144 Esqyfk.exe 1320 Cjoslavnmdd.exe 1920 Esqyfk.exe 2684 ctfmom.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 10 ip-api.com 6 api.ipify.org
Processes
-
C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"2⤵PID:420
-
-
C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"C:\Users\Admin\AppData\Local\Temp\260809d850f42fd71f5ddff0bf68a241a82595aa062d82fa5ca6c7bf8076ad15.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\Esqyfk.exe"C:\Users\Admin\AppData\Local\Temp\Esqyfk.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\Esqyfk.exe"C:\Users\Admin\AppData\Local\Temp\Esqyfk.exe"4⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵PID:2876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Cjoslavnmdd.exe"C:\Users\Admin\AppData\Local\Temp\Cjoslavnmdd.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵PID:4044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for installed software on the system
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3896 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles5⤵PID:852
-
-
-
C:\Users\Admin\AppData\Roaming\ctfmom.exe"C:\Users\Admin\AppData\Roaming\ctfmom.exe"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Executes dropped EXE
PID:2684
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Cjoslavnmdd.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵PID:2484
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 14202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1316
-