f4ca965db7cfd5944b5d6902f391f91f7c3994973955f2af97a91ec146977cc4

Analysis

max time kernel
25s
max time network
138s
platform
windows10_x64
resource
win10
submitted
30-06-2020 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MFC PROJECT DETAILS.exe
Size

406KB
MD5

0f594997983db981f447a2ee5d640129
SHA1

bf31d7905e28e9ab32348471bb7a497d82c6aff7
SHA256

f4ca965db7cfd5944b5d6902f391f91f7c3994973955f2af97a91ec146977cc4
SHA512

0ee59d76aaee737b67336c5fd142e7f175ac5dbfce33052fd2ae7ea39dae2279d9363f660529caf26ec899a81331c48a6d873b26f09376b0cdea7bfb94902f58

Score

5^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 7005 IoCs

Processes:

MFC PROJECT DETAILS.exe

pid	process
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe
3496	MFC PROJECT DETAILS.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious use of WriteProcessMemory 361 IoCs

Processes:

MFC PROJECT DETAILS.exeMFC PROJECT DETAILS.execmd.exeExplorer.EXEMFC PROJECT DETAILS.execmd.exeMFC PROJECT DETAILS.execmd.execmd.exeMFC PROJECT DETAILS.exe

description	pid	process	target process
PID 3496 wrote to memory of 3832	3496	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3496 wrote to memory of 3832	3496	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3496 wrote to memory of 3832	3496	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3496 wrote to memory of 3832	3496	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3496 wrote to memory of 3936	3496	MFC PROJECT DETAILS.exe	cmd.exe
PID 3496 wrote to memory of 3936	3496	MFC PROJECT DETAILS.exe	cmd.exe
PID 3496 wrote to memory of 3936	3496	MFC PROJECT DETAILS.exe	cmd.exe
PID 3496 wrote to memory of 3512	3496	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3496 wrote to memory of 3512	3496	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3496 wrote to memory of 3512	3496	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3512 wrote to memory of 3660	3512	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3512 wrote to memory of 3660	3512	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3512 wrote to memory of 3660	3512	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3512 wrote to memory of 3660	3512	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3936 wrote to memory of 4004	3936	cmd.exe	choice.exe
PID 3936 wrote to memory of 4004	3936	cmd.exe	choice.exe
PID 3936 wrote to memory of 4004	3936	cmd.exe	choice.exe
PID 3020 wrote to memory of 756	3020	Explorer.EXE	chkdsk.exe
PID 3020 wrote to memory of 756	3020	Explorer.EXE	chkdsk.exe
PID 3020 wrote to memory of 756	3020	Explorer.EXE	chkdsk.exe
PID 3512 wrote to memory of 4012	3512	MFC PROJECT DETAILS.exe	cmd.exe
PID 3512 wrote to memory of 4012	3512	MFC PROJECT DETAILS.exe	cmd.exe
PID 3512 wrote to memory of 4012	3512	MFC PROJECT DETAILS.exe	cmd.exe
PID 3512 wrote to memory of 3276	3512	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3512 wrote to memory of 3276	3512	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3512 wrote to memory of 3276	3512	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3276 wrote to memory of 648	3276	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3276 wrote to memory of 648	3276	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3276 wrote to memory of 648	3276	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3276 wrote to memory of 648	3276	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 4012 wrote to memory of 816	4012	cmd.exe	choice.exe
PID 4012 wrote to memory of 816	4012	cmd.exe	choice.exe
PID 4012 wrote to memory of 816	4012	cmd.exe	choice.exe
PID 3276 wrote to memory of 368	3276	MFC PROJECT DETAILS.exe	cmd.exe
PID 3276 wrote to memory of 368	3276	MFC PROJECT DETAILS.exe	cmd.exe
PID 3276 wrote to memory of 368	3276	MFC PROJECT DETAILS.exe	cmd.exe
PID 3276 wrote to memory of 1232	3276	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3276 wrote to memory of 1232	3276	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 3276 wrote to memory of 1232	3276	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 1232 wrote to memory of 1424	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1424	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1424	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1440	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1440	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1440	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1484	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1484	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1484	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1232 wrote to memory of 1484	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 368 wrote to memory of 1644	368	cmd.exe	choice.exe
PID 368 wrote to memory of 1644	368	cmd.exe	choice.exe
PID 368 wrote to memory of 1644	368	cmd.exe	choice.exe
PID 1232 wrote to memory of 1848	1232	MFC PROJECT DETAILS.exe	cmd.exe
PID 1232 wrote to memory of 1848	1232	MFC PROJECT DETAILS.exe	cmd.exe
PID 1232 wrote to memory of 1848	1232	MFC PROJECT DETAILS.exe	cmd.exe
PID 1232 wrote to memory of 2148	1232	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 1232 wrote to memory of 2148	1232	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 1232 wrote to memory of 2148	1232	MFC PROJECT DETAILS.exe	MFC PROJECT DETAILS.exe
PID 1848 wrote to memory of 2200	1848	cmd.exe	choice.exe
PID 1848 wrote to memory of 2200	1848	cmd.exe	choice.exe
PID 1848 wrote to memory of 2200	1848	cmd.exe	choice.exe
PID 2148 wrote to memory of 2384	2148	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 2148 wrote to memory of 2384	2148	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 2148 wrote to memory of 2384	2148	MFC PROJECT DETAILS.exe	RegAsm.exe

Suspicious behavior: MapViewOfSection 97 IoCs

Processes:

MFC PROJECT DETAILS.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeRegAsm.exeMFC PROJECT DETAILS.exeMFC PROJECT DETAILS.exeRegAsm.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exechkdsk.exeMFC PROJECT DETAILS.exeMFC PROJECT DETAILS.exeRegAsm.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exe

pid	process
3496	MFC PROJECT DETAILS.exe
3512	MFC PROJECT DETAILS.exe
3832	RegAsm.exe
3276	MFC PROJECT DETAILS.exe
3660	RegAsm.exe
1232	MFC PROJECT DETAILS.exe
1232	MFC PROJECT DETAILS.exe
1232	MFC PROJECT DETAILS.exe
648	RegAsm.exe
2148	MFC PROJECT DETAILS.exe
1484	RegAsm.exe
2384	RegAsm.exe
3108	MFC PROJECT DETAILS.exe
3108	MFC PROJECT DETAILS.exe
3824	MFC PROJECT DETAILS.exe
3316	RegAsm.exe
3832	RegAsm.exe
3832	RegAsm.exe
864	RegAsm.exe
628	MFC PROJECT DETAILS.exe
628	MFC PROJECT DETAILS.exe
1424	RegAsm.exe
1836	MFC PROJECT DETAILS.exe
1836	MFC PROJECT DETAILS.exe
1836	MFC PROJECT DETAILS.exe
1836	MFC PROJECT DETAILS.exe
2384	RegAsm.exe
2384	RegAsm.exe
1852	RegAsm.exe
420	MFC PROJECT DETAILS.exe
3660	RegAsm.exe
864	RegAsm.exe
864	RegAsm.exe
648	RegAsm.exe
3892	RegAsm.exe
756	chkdsk.exe
2172	MFC PROJECT DETAILS.exe
1484	RegAsm.exe
3860	MFC PROJECT DETAILS.exe
2540	RegAsm.exe
1852	RegAsm.exe
1852	RegAsm.exe
3316	RegAsm.exe
1856	RegAsm.exe
3720	MFC PROJECT DETAILS.exe
3660	RegAsm.exe
3660	RegAsm.exe
820	RegAsm.exe
3224	MFC PROJECT DETAILS.exe
648	RegAsm.exe
648	RegAsm.exe
3892	RegAsm.exe
3892	RegAsm.exe
1424	RegAsm.exe
3912	RegAsm.exe
2540	RegAsm.exe
2540	RegAsm.exe
420	MFC PROJECT DETAILS.exe
756	chkdsk.exe
1232	RegAsm.exe
1408	MFC PROJECT DETAILS.exe
3704	RegAsm.exe
1484	RegAsm.exe
1484	RegAsm.exe

Suspicious use of SetThreadContext 53 IoCs

Processes:

MFC PROJECT DETAILS.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeMFC PROJECT DETAILS.exeRegAsm.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exechkdsk.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exe

description	pid	process	target process
PID 3496 set thread context of 3832	3496	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3512 set thread context of 3660	3512	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3832 set thread context of 3020	3832	RegAsm.exe	Explorer.EXE
PID 3276 set thread context of 648	3276	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3660 set thread context of 3020	3660	RegAsm.exe	Explorer.EXE
PID 1232 set thread context of 1484	1232	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 648 set thread context of 3020	648	RegAsm.exe	Explorer.EXE
PID 2148 set thread context of 2384	2148	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1484 set thread context of 3020	1484	RegAsm.exe	Explorer.EXE
PID 3108 set thread context of 3316	3108	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 2384 set thread context of 3020	2384	RegAsm.exe	Explorer.EXE
PID 3824 set thread context of 864	3824	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3316 set thread context of 3020	3316	RegAsm.exe	Explorer.EXE
PID 864 set thread context of 3020	864	RegAsm.exe	Explorer.EXE
PID 628 set thread context of 1424	628	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1424 set thread context of 3020	1424	RegAsm.exe	Explorer.EXE
PID 1836 set thread context of 1852	1836	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1852 set thread context of 3020	1852	RegAsm.exe	Explorer.EXE
PID 420 set thread context of 3892	420	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3660 set thread context of 3020	3660	RegAsm.exe	Explorer.EXE
PID 648 set thread context of 3020	648	RegAsm.exe	Explorer.EXE
PID 3892 set thread context of 3020	3892	RegAsm.exe	Explorer.EXE
PID 2172 set thread context of 2540	2172	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1484 set thread context of 3020	1484	RegAsm.exe	Explorer.EXE
PID 3860 set thread context of 1856	3860	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 2540 set thread context of 3020	2540	RegAsm.exe	Explorer.EXE
PID 3316 set thread context of 3020	3316	RegAsm.exe	Explorer.EXE
PID 1856 set thread context of 3020	1856	RegAsm.exe	Explorer.EXE
PID 3720 set thread context of 820	3720	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 820 set thread context of 3020	820	RegAsm.exe	Explorer.EXE
PID 3224 set thread context of 3912	3224	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1424 set thread context of 3020	1424	RegAsm.exe	Explorer.EXE
PID 3912 set thread context of 3020	3912	RegAsm.exe	Explorer.EXE
PID 420 set thread context of 1232	420	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 756 set thread context of 3020	756	chkdsk.exe	Explorer.EXE
PID 1232 set thread context of 3020	1232	RegAsm.exe	Explorer.EXE
PID 1408 set thread context of 3704	1408	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3704 set thread context of 3020	3704	RegAsm.exe	Explorer.EXE
PID 2988 set thread context of 1156	2988	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1856 set thread context of 3020	1856	RegAsm.exe	Explorer.EXE
PID 820 set thread context of 3020	820	RegAsm.exe	Explorer.EXE
PID 1156 set thread context of 3020	1156	RegAsm.exe	Explorer.EXE
PID 3420 set thread context of 1628	3420	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 3912 set thread context of 3020	3912	RegAsm.exe	Explorer.EXE
PID 1628 set thread context of 3020	1628	RegAsm.exe	Explorer.EXE
PID 1232 set thread context of 3020	1232	RegAsm.exe	Explorer.EXE
PID 424 set thread context of 1328	424	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 1328 set thread context of 3020	1328	RegAsm.exe	Explorer.EXE
PID 2076 set thread context of 2688	2076	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 2688 set thread context of 3020	2688	RegAsm.exe	Explorer.EXE
PID 3844 set thread context of 764	3844	MFC PROJECT DETAILS.exe	RegAsm.exe
PID 764 set thread context of 3020	764	RegAsm.exe	Explorer.EXE
PID 2340 set thread context of 3512	2340	MFC PROJECT DETAILS.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 92 IoCs

Processes:

MFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exeExplorer.EXEchkdsk.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exewscript.exeMFC PROJECT DETAILS.exeRegAsm.exeipconfig.exeMFC PROJECT DETAILS.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.execscript.exeMFC PROJECT DETAILS.exeRegAsm.exesvchost.exeMFC PROJECT DETAILS.exeRegAsm.exemsiexec.exewscript.exeMFC PROJECT DETAILS.execontrol.exeRegAsm.exeMFC PROJECT DETAILS.exeRegAsm.exemsdt.exeMFC PROJECT DETAILS.exe

description	pid	process
Token: SeDebugPrivilege	3496	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3832	RegAsm.exe
Token: SeDebugPrivilege	3512	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3660	RegAsm.exe
Token: SeDebugPrivilege	3276	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	648	RegAsm.exe
Token: SeDebugPrivilege	1232	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	1484	RegAsm.exe
Token: SeDebugPrivilege	2148	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	2384	RegAsm.exe
Token: SeDebugPrivilege	3108	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3316	RegAsm.exe
Token: SeDebugPrivilege	3824	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	864	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	756	chkdsk.exe
Token: SeDebugPrivilege	628	MFC PROJECT DETAILS.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	1424	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	1836	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	1852	RegAsm.exe
Token: SeDebugPrivilege	2140	wscript.exe
Token: SeDebugPrivilege	420	MFC PROJECT DETAILS.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	3892	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	2228	ipconfig.exe
Token: SeDebugPrivilege	2172	MFC PROJECT DETAILS.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	2540	RegAsm.exe
Token: SeDebugPrivilege	3860	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	1856	RegAsm.exe
Token: SeDebugPrivilege	980	cscript.exe
Token: SeDebugPrivilege	3720	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	820	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	3708	svchost.exe
Token: SeDebugPrivilege	3224	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3912	RegAsm.exe
Token: SeDebugPrivilege	912	msiexec.exe
Token: SeDebugPrivilege	1092	wscript.exe
Token: SeDebugPrivilege	420	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3680	control.exe
Token: SeDebugPrivilege	1232	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	1408	MFC PROJECT DETAILS.exe
Token: SeDebugPrivilege	3704	RegAsm.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE
Token: SeDebugPrivilege	2196	msdt.exe
Token: SeDebugPrivilege	2988	MFC PROJECT DETAILS.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
7⤵
PID:1048

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
7⤵
PID:2840

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
9⤵
PID:3840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
8⤵
PID:3836

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
9⤵
PID:3476

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
PID:3032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
11⤵
PID:3592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
10⤵
PID:3948

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:1236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:3376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:3648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
11⤵
PID:752

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:368

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
12⤵
PID:1828

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
13⤵
PID:704

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
13⤵
PID:3724

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
14⤵
PID:3376

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
15⤵
PID:2688

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
15⤵
PID:3060

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
16⤵
PID:2836

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
16⤵
PID:3824

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
17⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
17⤵
PID:1780

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
18⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
18⤵
PID:1900

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
19⤵
PID:2060

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
- Suspicious use of SetThreadContext
PID:1156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
19⤵
PID:3932

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
20⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
19⤵
- Suspicious use of SetThreadContext
PID:3420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
- Suspicious use of SetThreadContext
PID:1628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
20⤵
PID:2336

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
21⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
20⤵
- Suspicious use of SetThreadContext
PID:424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
- Suspicious use of SetThreadContext
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
21⤵
PID:1020

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
22⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
21⤵
- Suspicious use of SetThreadContext
PID:2076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
- Suspicious use of SetThreadContext
PID:2688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
22⤵
PID:3028

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
23⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
22⤵
- Suspicious use of SetThreadContext
PID:3844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
- Suspicious use of SetThreadContext
PID:764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
23⤵
PID:1220

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
24⤵
PID:4012

C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
23⤵
- Suspicious use of SetThreadContext
PID:2340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:3512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MFC PROJECT DETAILS.exe"
24⤵
PID:2544

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Enumerates system info in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:572

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:912

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:4012

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1220

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2152

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2092

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
PID:3328

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:3952

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:3012

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
PID:1828

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
PID:1792

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
PID:3972

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:2524

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:2812

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:2060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-12-0x0000000000000000-mapping.dmp

Download
memory/368-64-0x0000000000000000-mapping.dmp

Download
memory/420-96-0x0000000000000000-mapping.dmp

Download
memory/420-54-0x0000000000000000-mapping.dmp

Download
memory/424-142-0x0000000000000000-mapping.dmp

Download
memory/572-41-0x0000000000000000-mapping.dmp

Download
memory/628-38-0x0000000000000000-mapping.dmp

Download
memory/648-10-0x000000000041E2B0-mapping.dmp

Download
memory/704-68-0x0000000000000000-mapping.dmp

Download
memory/752-49-0x0000000000000000-mapping.dmp

Download
memory/756-35-0x0000000000D70000-0x0000000000D7A000-memory.dmp

Filesize
40KB

Download
memory/756-107-0x0000000074170000-0x00000000742AC000-memory.dmp

Filesize
1.2MB

Download
memory/756-105-0x00000000056F0000-0x00000000057FB000-memory.dmp

Filesize
1.0MB

Download
memory/756-32-0x0000000000000000-mapping.dmp

Download
memory/756-33-0x0000000000D70000-0x0000000000D7A000-memory.dmp

Filesize
40KB

Download
memory/764-164-0x000000000041E2B0-mapping.dmp

Download
memory/816-11-0x0000000000000000-mapping.dmp

Download
memory/820-80-0x000000000041E2B0-mapping.dmp

Download
memory/820-36-0x0000000000000000-mapping.dmp

Download
memory/864-30-0x000000000041E2B0-mapping.dmp

Download
memory/912-90-0x0000000001330000-0x0000000001342000-memory.dmp

Filesize
72KB

Download
memory/912-92-0x0000000001330000-0x0000000001342000-memory.dmp

Filesize
72KB

Download
memory/912-89-0x0000000000000000-mapping.dmp

Download
memory/980-78-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download
memory/980-77-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download
memory/980-76-0x0000000000000000-mapping.dmp

Download
memory/1020-151-0x0000000000000000-mapping.dmp

Download
memory/1020-176-0x0000000000000000-mapping.dmp

Download
memory/1092-94-0x00000000011C0000-0x00000000011E7000-memory.dmp

Filesize
156KB

Download
memory/1092-93-0x00000000011C0000-0x00000000011E7000-memory.dmp

Filesize
156KB

Download
memory/1092-91-0x0000000000000000-mapping.dmp

Download
memory/1156-119-0x000000000041E2B0-mapping.dmp

Download
memory/1220-166-0x0000000000000000-mapping.dmp

Download
memory/1232-103-0x000000000041E2B0-mapping.dmp

Download
memory/1232-13-0x0000000000000000-mapping.dmp

Download
memory/1328-150-0x000000000041E2B0-mapping.dmp

Download
memory/1408-108-0x0000000000000000-mapping.dmp

Download
memory/1424-40-0x000000000041E2B0-mapping.dmp

Download
memory/1484-15-0x000000000041E2B0-mapping.dmp

Download
memory/1628-128-0x000000000041E2B0-mapping.dmp

Download
memory/1640-160-0x0000000000000000-mapping.dmp

Download
memory/1644-16-0x0000000000000000-mapping.dmp

Download
memory/1684-152-0x0000000000000000-mapping.dmp

Download
memory/1780-104-0x0000000000000000-mapping.dmp

Download
memory/1792-145-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/1792-143-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/1792-141-0x0000000000000000-mapping.dmp

Download
memory/1828-148-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/1828-147-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/1828-144-0x0000000000000000-mapping.dmp

Download
memory/1828-59-0x0000000000000000-mapping.dmp

Download
memory/1836-44-0x0000000000000000-mapping.dmp

Download
memory/1848-17-0x0000000000000000-mapping.dmp

Download
memory/1852-47-0x000000000041E2B0-mapping.dmp

Download
memory/1856-71-0x000000000041E2B0-mapping.dmp

Download
memory/1900-112-0x0000000000000000-mapping.dmp

Download
memory/2060-123-0x0000000000000000-mapping.dmp

Download
memory/2076-153-0x0000000000000000-mapping.dmp

Download
memory/2140-52-0x00000000011C0000-0x00000000011E7000-memory.dmp

Filesize
156KB

Download
memory/2140-51-0x00000000011C0000-0x00000000011E7000-memory.dmp

Filesize
156KB

Download
memory/2140-50-0x0000000000000000-mapping.dmp

Download
memory/2144-74-0x0000000000000000-mapping.dmp

Download
memory/2144-165-0x0000000000000000-mapping.dmp

Download
memory/2148-18-0x0000000000000000-mapping.dmp

Download
memory/2160-48-0x0000000000000000-mapping.dmp

Download
memory/2172-63-0x0000000000000000-mapping.dmp

Download
memory/2196-116-0x0000000000D40000-0x0000000000EB3000-memory.dmp

Filesize
1.4MB

Download
memory/2196-117-0x0000000000D40000-0x0000000000EB3000-memory.dmp

Filesize
1.4MB

Download
memory/2196-113-0x0000000000000000-mapping.dmp

Download
memory/2200-19-0x0000000000000000-mapping.dmp

Download
memory/2228-61-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/2228-58-0x0000000000000000-mapping.dmp

Download
memory/2228-60-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/2232-146-0x0000000000000000-mapping.dmp

Download
memory/2336-135-0x0000000000000000-mapping.dmp

Download
memory/2336-42-0x0000000000000000-mapping.dmp

Download
memory/2340-170-0x0000000000000000-mapping.dmp

Download
memory/2384-21-0x000000000041E2B0-mapping.dmp

Download
memory/2524-169-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download
memory/2524-168-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Filesize
156KB

Download
memory/2524-167-0x0000000000000000-mapping.dmp

Download
memory/2540-66-0x000000000041E2B0-mapping.dmp

Download
memory/2544-175-0x0000000000000000-mapping.dmp

Download
memory/2688-158-0x000000000041E2B0-mapping.dmp

Download
memory/2688-85-0x0000000000000000-mapping.dmp

Download
memory/2836-98-0x0000000000000000-mapping.dmp

Download
memory/2840-22-0x0000000000000000-mapping.dmp

Download
memory/2988-114-0x0000000000000000-mapping.dmp

Download
memory/3008-26-0x0000000000000000-mapping.dmp

Download
memory/3016-115-0x0000000000000000-mapping.dmp

Download
memory/3020-106-0x000000000B400000-0x000000000B574000-memory.dmp

Filesize
1.5MB

Download
memory/3020-171-0x000000000A690000-0x000000000A773000-memory.dmp

Filesize
908KB

Download
memory/3020-37-0x0000000009510000-0x00000000096A1000-memory.dmp

Filesize
1.6MB

Download
memory/3020-53-0x00000000096B0000-0x00000000097C2000-memory.dmp

Filesize
1.1MB

Download
memory/3020-31-0x00000000077C0000-0x0000000007949000-memory.dmp

Filesize
1.5MB

Download
memory/3020-139-0x000000000BDB0000-0x000000000BF4B000-memory.dmp

Filesize
1.6MB

Download
memory/3020-162-0x000000000C0E0000-0x000000000C287000-memory.dmp

Filesize
1.7MB

Download
memory/3020-121-0x000000000BAB0000-0x000000000BBCE000-memory.dmp

Filesize
1.1MB

Download
memory/3020-62-0x0000000009D10000-0x0000000009E6E000-memory.dmp

Filesize
1.4MB

Download
memory/3020-99-0x000000000B2C0000-0x000000000B3F6000-memory.dmp

Filesize
1.2MB

Download
memory/3020-45-0x0000000007B00000-0x0000000007BCC000-memory.dmp

Filesize
816KB

Download
memory/3020-57-0x0000000008080000-0x0000000008177000-memory.dmp

Filesize
988KB

Download
memory/3020-72-0x00000000097D0000-0x000000000988F000-memory.dmp

Filesize
764KB

Download
memory/3028-159-0x0000000000000000-mapping.dmp

Download
memory/3060-82-0x0000000000000000-mapping.dmp

Download
memory/3108-23-0x0000000000000000-mapping.dmp

Download
memory/3224-86-0x0000000000000000-mapping.dmp

Download
memory/3276-8-0x0000000000000000-mapping.dmp

Download
memory/3316-25-0x000000000041E2B0-mapping.dmp

Download
memory/3328-133-0x0000000000D40000-0x0000000000EB3000-memory.dmp

Filesize
1.4MB

Download
memory/3328-131-0x0000000000000000-mapping.dmp

Download
memory/3328-134-0x0000000000D40000-0x0000000000EB3000-memory.dmp

Filesize
1.4MB

Download
memory/3376-73-0x0000000000000000-mapping.dmp

Download
memory/3420-125-0x0000000000000000-mapping.dmp

Download
memory/3476-34-0x0000000000000000-mapping.dmp

Download
memory/3512-173-0x000000000041E2B0-mapping.dmp

Download
memory/3512-3-0x0000000000000000-mapping.dmp

Download
memory/3592-130-0x0000000000F20000-0x0000000000F79000-memory.dmp

Filesize
356KB

Download
memory/3592-132-0x0000000000F20000-0x0000000000F79000-memory.dmp

Filesize
356KB

Download
memory/3592-129-0x0000000000000000-mapping.dmp

Download
memory/3604-111-0x0000000000000000-mapping.dmp

Download
memory/3660-5-0x000000000041E2B0-mapping.dmp

Download
memory/3680-101-0x0000000001040000-0x0000000001060000-memory.dmp

Filesize
128KB

Download
memory/3680-97-0x0000000000000000-mapping.dmp

Download
memory/3680-100-0x0000000001040000-0x0000000001060000-memory.dmp

Filesize
128KB

Download
memory/3704-110-0x000000000041E2B0-mapping.dmp

Download
memory/3708-83-0x0000000001210000-0x000000000121C000-memory.dmp

Filesize
48KB

Download
memory/3708-84-0x0000000001210000-0x000000000121C000-memory.dmp

Filesize
48KB

Download
memory/3708-81-0x0000000000000000-mapping.dmp

Download
memory/3720-75-0x0000000000000000-mapping.dmp

Download
memory/3724-67-0x0000000000000000-mapping.dmp

Download
memory/3824-95-0x0000000000000000-mapping.dmp

Download
memory/3824-28-0x0000000000000000-mapping.dmp

Download
memory/3832-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3832-1-0x000000000041E2B0-mapping.dmp

Download
memory/3836-27-0x0000000000000000-mapping.dmp

Download
memory/3840-122-0x0000000000000000-mapping.dmp

Download
memory/3840-124-0x0000000000EE0000-0x000000000131F000-memory.dmp

Filesize
4.2MB

Download
memory/3840-126-0x0000000000EE0000-0x000000000131F000-memory.dmp

Filesize
4.2MB

Download
memory/3844-161-0x0000000000000000-mapping.dmp

Download
memory/3860-69-0x0000000000000000-mapping.dmp

Download
memory/3892-56-0x000000000041E2B0-mapping.dmp

Download
memory/3912-88-0x000000000041E2B0-mapping.dmp

Download
memory/3932-120-0x0000000000000000-mapping.dmp

Download
memory/3936-2-0x0000000000000000-mapping.dmp

Download
memory/3948-43-0x0000000000000000-mapping.dmp

Download
memory/3952-138-0x0000000000140000-0x0000000000157000-memory.dmp

Filesize
92KB

Download
memory/3952-137-0x0000000000140000-0x0000000000157000-memory.dmp

Filesize
92KB

Download
memory/3952-136-0x0000000000000000-mapping.dmp

Download
memory/3972-156-0x0000000001240000-0x000000000125F000-memory.dmp

Filesize
124KB

Download
memory/3972-155-0x0000000001240000-0x000000000125F000-memory.dmp

Filesize
124KB

Download
memory/3972-154-0x0000000000000000-mapping.dmp

Download
memory/4004-6-0x0000000000000000-mapping.dmp

Download
memory/4012-7-0x0000000000000000-mapping.dmp

Download
memory/4012-174-0x0000000000000000-mapping.dmp

Download