Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 07:04
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Quotation.exe
-
Size
267KB
-
MD5
1f2e931a76dbfac440c933b05a2c8e03
-
SHA1
5a88cfede5d282779cd290241d00be1012967c1f
-
SHA256
e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322
-
SHA512
36d3fe9e87a96782c6444bdad565c3abee88c17905fe8ab8213b33d2af44c48b4dc2b2582f371e897978893b271161c7d0f8b975057038cdc02f589529e31c9b
Malware Config
Signatures
-
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\5JMDUFWHU68 = "C:\\Program Files (x86)\\Mvtg4dx\\igfxwnuxv4rh.exe" colorcpl.exe -
Suspicious use of WriteProcessMemory 1123 IoCs
Processes:
Quotation.exeExplorer.EXEQuotation.execolorcpl.exeQuotation.exeQuotation.exedescription pid process target process PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 1608 1460 Quotation.exe RegAsm.exe PID 1460 wrote to memory of 788 1460 Quotation.exe Quotation.exe PID 1460 wrote to memory of 788 1460 Quotation.exe Quotation.exe PID 1460 wrote to memory of 788 1460 Quotation.exe Quotation.exe PID 1460 wrote to memory of 788 1460 Quotation.exe Quotation.exe PID 1244 wrote to memory of 1056 1244 Explorer.EXE colorcpl.exe PID 1244 wrote to memory of 1056 1244 Explorer.EXE colorcpl.exe PID 1244 wrote to memory of 1056 1244 Explorer.EXE colorcpl.exe PID 1244 wrote to memory of 1056 1244 Explorer.EXE colorcpl.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1040 788 Quotation.exe RegAsm.exe PID 788 wrote to memory of 1684 788 Quotation.exe Quotation.exe PID 788 wrote to memory of 1684 788 Quotation.exe Quotation.exe PID 788 wrote to memory of 1684 788 Quotation.exe Quotation.exe PID 788 wrote to memory of 1684 788 Quotation.exe Quotation.exe PID 1056 wrote to memory of 1772 1056 colorcpl.exe cmd.exe PID 1056 wrote to memory of 1772 1056 colorcpl.exe cmd.exe PID 1056 wrote to memory of 1772 1056 colorcpl.exe cmd.exe PID 1056 wrote to memory of 1772 1056 colorcpl.exe cmd.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1872 1684 Quotation.exe RegAsm.exe PID 1684 wrote to memory of 1884 1684 Quotation.exe Quotation.exe PID 1684 wrote to memory of 1884 1684 Quotation.exe Quotation.exe PID 1684 wrote to memory of 1884 1684 Quotation.exe Quotation.exe PID 1684 wrote to memory of 1884 1684 Quotation.exe Quotation.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1244 wrote to memory of 1868 1244 Explorer.EXE rundll32.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1824 1884 Quotation.exe RegAsm.exe PID 1884 wrote to memory of 1756 1884 Quotation.exe Quotation.exe PID 1884 wrote to memory of 1756 1884 Quotation.exe Quotation.exe PID 1884 wrote to memory of 1756 1884 Quotation.exe Quotation.exe PID 1884 wrote to memory of 1756 1884 Quotation.exe Quotation.exe PID 1244 wrote to memory of 1588 1244 Explorer.EXE rundll32.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 15514 IoCs
Processes:
Quotation.exepid process 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe 1460 Quotation.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
chkdsk.exechkdsk.exechkdsk.exechkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: MapViewOfSection 276 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exepid process 1460 Quotation.exe 1608 RegAsm.exe 788 Quotation.exe 1040 RegAsm.exe 1608 RegAsm.exe 1608 RegAsm.exe 1684 Quotation.exe 1872 RegAsm.exe 1056 colorcpl.exe 1884 Quotation.exe 1824 RegAsm.exe 1872 RegAsm.exe 1872 RegAsm.exe 1040 RegAsm.exe 1756 Quotation.exe 1556 RegAsm.exe 1824 RegAsm.exe 1824 RegAsm.exe 1056 colorcpl.exe 1980 Quotation.exe 1040 RegAsm.exe 1040 RegAsm.exe 2012 RegAsm.exe 1996 Quotation.exe 240 RegAsm.exe 1556 RegAsm.exe 1204 Quotation.exe 756 RegAsm.exe 240 RegAsm.exe 240 RegAsm.exe 2012 RegAsm.exe 880 Quotation.exe 1644 RegAsm.exe 756 RegAsm.exe 756 RegAsm.exe 1520 Quotation.exe 1520 Quotation.exe 2012 RegAsm.exe 2012 RegAsm.exe 1564 RegAsm.exe 1556 RegAsm.exe 1556 RegAsm.exe 1644 RegAsm.exe 1644 RegAsm.exe 1412 Quotation.exe 1636 RegAsm.exe 1564 RegAsm.exe 1564 RegAsm.exe 1120 Quotation.exe 2040 RegAsm.exe 1752 Quotation.exe 1424 RegAsm.exe 2040 RegAsm.exe 2040 RegAsm.exe 1636 RegAsm.exe 1592 Quotation.exe 1932 RegAsm.exe 1424 RegAsm.exe 1424 RegAsm.exe 572 Quotation.exe 572 Quotation.exe 1036 RegAsm.exe 1932 RegAsm.exe 1932 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 190 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exewlanext.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exemsdt.exeQuotation.exeRegAsm.exeNETSTAT.EXEQuotation.exeRegAsm.exewuapp.exeexplorer.exeipconfig.exeQuotation.exeRegAsm.execmstp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.exewscript.exeQuotation.exeRegAsm.exechkdsk.exeQuotation.exeRegAsm.exewuapp.exemsiexec.exeQuotation.exeRegAsm.execmmon32.exeQuotation.exeRegAsm.execontrol.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.execmstp.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1460 Quotation.exe Token: SeDebugPrivilege 1608 RegAsm.exe Token: SeDebugPrivilege 788 Quotation.exe Token: SeDebugPrivilege 1040 RegAsm.exe Token: SeDebugPrivilege 1056 colorcpl.exe Token: SeDebugPrivilege 1684 Quotation.exe Token: SeDebugPrivilege 1872 RegAsm.exe Token: SeDebugPrivilege 1884 Quotation.exe Token: SeDebugPrivilege 1824 RegAsm.exe Token: SeDebugPrivilege 1868 rundll32.exe Token: SeDebugPrivilege 1756 Quotation.exe Token: SeDebugPrivilege 1556 RegAsm.exe Token: SeDebugPrivilege 1588 rundll32.exe Token: SeDebugPrivilege 1980 Quotation.exe Token: SeDebugPrivilege 2012 RegAsm.exe Token: SeDebugPrivilege 1740 wlanext.exe Token: SeDebugPrivilege 1996 Quotation.exe Token: SeDebugPrivilege 240 RegAsm.exe Token: SeDebugPrivilege 1204 Quotation.exe Token: SeDebugPrivilege 756 RegAsm.exe Token: SeDebugPrivilege 1568 msdt.exe Token: SeDebugPrivilege 880 Quotation.exe Token: SeDebugPrivilege 1644 RegAsm.exe Token: SeDebugPrivilege 544 NETSTAT.EXE Token: SeDebugPrivilege 1520 Quotation.exe Token: SeDebugPrivilege 1564 RegAsm.exe Token: SeDebugPrivilege 1064 wuapp.exe Token: SeDebugPrivilege 1820 explorer.exe Token: SeDebugPrivilege 1404 ipconfig.exe Token: SeDebugPrivilege 1412 Quotation.exe Token: SeDebugPrivilege 1636 RegAsm.exe Token: SeDebugPrivilege 788 cmstp.exe Token: SeDebugPrivilege 1120 Quotation.exe Token: SeDebugPrivilege 2040 RegAsm.exe Token: SeDebugPrivilege 1752 Quotation.exe Token: SeDebugPrivilege 1424 RegAsm.exe Token: SeDebugPrivilege 1536 svchost.exe Token: SeDebugPrivilege 1592 Quotation.exe Token: SeDebugPrivilege 1932 RegAsm.exe Token: SeDebugPrivilege 752 wscript.exe Token: SeDebugPrivilege 572 Quotation.exe Token: SeDebugPrivilege 1036 RegAsm.exe Token: SeDebugPrivilege 612 chkdsk.exe Token: SeDebugPrivilege 1440 Quotation.exe Token: SeDebugPrivilege 1920 RegAsm.exe Token: SeDebugPrivilege 1152 wuapp.exe Token: SeDebugPrivilege 1516 msiexec.exe Token: SeDebugPrivilege 1880 Quotation.exe Token: SeDebugPrivilege 1408 RegAsm.exe Token: SeDebugPrivilege 1708 cmmon32.exe Token: SeDebugPrivilege 1828 Quotation.exe Token: SeDebugPrivilege 1956 RegAsm.exe Token: SeDebugPrivilege 1848 control.exe Token: SeDebugPrivilege 800 Quotation.exe Token: SeDebugPrivilege 1576 RegAsm.exe Token: SeDebugPrivilege 1584 svchost.exe Token: SeDebugPrivilege 1620 Quotation.exe Token: SeDebugPrivilege 1160 RegAsm.exe Token: SeDebugPrivilege 1976 cmstp.exe Token: SeDebugPrivilege 1560 Quotation.exe Token: SeDebugPrivilege 836 RegAsm.exe Token: SeDebugPrivilege 1460 help.exe Token: SeDebugPrivilege 1752 Quotation.exe Token: SeDebugPrivilege 1260 RegAsm.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
colorcpl.exedescription ioc process File opened for modification C:\Program Files (x86)\Mvtg4dx\igfxwnuxv4rh.exe colorcpl.exe -
Suspicious use of SetThreadContext 140 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exedescription pid process target process PID 1460 set thread context of 1608 1460 Quotation.exe RegAsm.exe PID 1608 set thread context of 1244 1608 RegAsm.exe Explorer.EXE PID 788 set thread context of 1040 788 Quotation.exe RegAsm.exe PID 1040 set thread context of 1244 1040 RegAsm.exe Explorer.EXE PID 1684 set thread context of 1872 1684 Quotation.exe RegAsm.exe PID 1872 set thread context of 1244 1872 RegAsm.exe Explorer.EXE PID 1884 set thread context of 1824 1884 Quotation.exe RegAsm.exe PID 1824 set thread context of 1244 1824 RegAsm.exe Explorer.EXE PID 1040 set thread context of 1244 1040 RegAsm.exe Explorer.EXE PID 1756 set thread context of 1556 1756 Quotation.exe RegAsm.exe PID 1556 set thread context of 1244 1556 RegAsm.exe Explorer.EXE PID 1056 set thread context of 1244 1056 colorcpl.exe Explorer.EXE PID 1980 set thread context of 2012 1980 Quotation.exe RegAsm.exe PID 2012 set thread context of 1244 2012 RegAsm.exe Explorer.EXE PID 1996 set thread context of 240 1996 Quotation.exe RegAsm.exe PID 240 set thread context of 1244 240 RegAsm.exe Explorer.EXE PID 1556 set thread context of 1244 1556 RegAsm.exe Explorer.EXE PID 1204 set thread context of 756 1204 Quotation.exe RegAsm.exe PID 756 set thread context of 1244 756 RegAsm.exe Explorer.EXE PID 2012 set thread context of 1244 2012 RegAsm.exe Explorer.EXE PID 880 set thread context of 1644 880 Quotation.exe RegAsm.exe PID 1644 set thread context of 1244 1644 RegAsm.exe Explorer.EXE PID 1520 set thread context of 1564 1520 Quotation.exe RegAsm.exe PID 1564 set thread context of 1244 1564 RegAsm.exe Explorer.EXE PID 1412 set thread context of 1636 1412 Quotation.exe RegAsm.exe PID 1636 set thread context of 1244 1636 RegAsm.exe Explorer.EXE PID 1120 set thread context of 2040 1120 Quotation.exe RegAsm.exe PID 2040 set thread context of 1244 2040 RegAsm.exe Explorer.EXE PID 1752 set thread context of 1424 1752 Quotation.exe RegAsm.exe PID 1424 set thread context of 1244 1424 RegAsm.exe Explorer.EXE PID 1636 set thread context of 1244 1636 RegAsm.exe Explorer.EXE PID 1592 set thread context of 1932 1592 Quotation.exe RegAsm.exe PID 1932 set thread context of 1244 1932 RegAsm.exe Explorer.EXE PID 572 set thread context of 1036 572 Quotation.exe RegAsm.exe PID 1036 set thread context of 1244 1036 RegAsm.exe Explorer.EXE PID 1440 set thread context of 1920 1440 Quotation.exe RegAsm.exe PID 1920 set thread context of 1244 1920 RegAsm.exe Explorer.EXE PID 1880 set thread context of 1408 1880 Quotation.exe RegAsm.exe PID 1408 set thread context of 1244 1408 RegAsm.exe Explorer.EXE PID 1828 set thread context of 1956 1828 Quotation.exe RegAsm.exe PID 1956 set thread context of 1244 1956 RegAsm.exe Explorer.EXE PID 800 set thread context of 1576 800 Quotation.exe RegAsm.exe PID 1576 set thread context of 1244 1576 RegAsm.exe Explorer.EXE PID 1620 set thread context of 1160 1620 Quotation.exe RegAsm.exe PID 1160 set thread context of 1244 1160 RegAsm.exe Explorer.EXE PID 1560 set thread context of 836 1560 Quotation.exe RegAsm.exe PID 836 set thread context of 1244 836 RegAsm.exe Explorer.EXE PID 1752 set thread context of 1260 1752 Quotation.exe RegAsm.exe PID 1260 set thread context of 1244 1260 RegAsm.exe Explorer.EXE PID 1792 set thread context of 1480 1792 Quotation.exe RegAsm.exe PID 1480 set thread context of 1244 1480 RegAsm.exe Explorer.EXE PID 880 set thread context of 1472 880 Quotation.exe RegAsm.exe PID 1472 set thread context of 1244 1472 RegAsm.exe Explorer.EXE PID 1800 set thread context of 832 1800 Quotation.exe RegAsm.exe PID 832 set thread context of 1244 832 RegAsm.exe Explorer.EXE PID 1480 set thread context of 1244 1480 RegAsm.exe Explorer.EXE PID 1692 set thread context of 1120 1692 Quotation.exe RegAsm.exe PID 1120 set thread context of 1244 1120 RegAsm.exe Explorer.EXE PID 1520 set thread context of 1164 1520 Quotation.exe RegAsm.exe PID 1164 set thread context of 1244 1164 RegAsm.exe Explorer.EXE PID 564 set thread context of 880 564 Quotation.exe RegAsm.exe PID 880 set thread context of 1244 880 RegAsm.exe Explorer.EXE PID 1120 set thread context of 1244 1120 RegAsm.exe Explorer.EXE PID 1084 set thread context of 1788 1084 Quotation.exe RegAsm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1460 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1684 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1756 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1556 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:240 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:756 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵PID:1512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1412 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1636 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵PID:320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1440 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:836 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"24⤵
- Suspicious use of SetThreadContext
PID:1792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
- Suspicious use of SetThreadContext
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"25⤵
- Suspicious use of SetThreadContext
PID:880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of SetThreadContext
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"26⤵
- Suspicious use of SetThreadContext
PID:1800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
- Suspicious use of SetThreadContext
PID:832 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"27⤵
- Suspicious use of SetThreadContext
PID:1692 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Suspicious use of SetThreadContext
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"28⤵
- Suspicious use of SetThreadContext
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
- Suspicious use of SetThreadContext
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"29⤵
- Suspicious use of SetThreadContext
PID:564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵PID:2032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
- Suspicious use of SetThreadContext
PID:880 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"30⤵
- Suspicious use of SetThreadContext
PID:1084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"31⤵PID:1428
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"32⤵PID:1340
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"33⤵PID:1940
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"34⤵PID:1888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"35⤵PID:1496
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"36⤵PID:1864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"37⤵PID:1880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"38⤵PID:1792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"39⤵PID:1492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"40⤵PID:1796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"41⤵PID:524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"42⤵PID:1380
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"43⤵PID:1452
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"44⤵PID:1880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"45⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:2124
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"46⤵PID:2160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵PID:2216
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"48⤵
- Enumerates system info in registry
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"47⤵PID:2244
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"48⤵PID:2324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"49⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"50⤵PID:2484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"51⤵PID:2568
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵PID:2620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵PID:2628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"52⤵PID:2664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵PID:2824
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"54⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"53⤵PID:2860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"54⤵PID:2940
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"55⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"56⤵PID:1908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"57⤵PID:1876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"58⤵PID:2096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"59⤵PID:2300
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"60⤵PID:2528
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"61⤵PID:2400
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"62⤵PID:2736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"63⤵PID:2584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"64⤵PID:2668
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵PID:1776
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"65⤵PID:2876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"66⤵PID:2212
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1148
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1060
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1044
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- System policy modification
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious use of SetThreadContext
PID:1056 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1772
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1944
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:752 -
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:612 -
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1288
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:572
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵PID:1144
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵PID:1376
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:1560
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵PID:1752
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1980
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1072
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1084
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1416
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:572
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1620
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:436
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:564
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1188
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1532
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1132
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1864
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:940
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵PID:748
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵PID:1916
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵PID:1928
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵PID:436
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:1060
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵PID:1132
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵PID:1620
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵PID:1656
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵PID:1692
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵PID:1936
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵PID:1256
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵PID:1864
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
PID:2032 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵PID:1860
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵PID:1684
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵PID:1436
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵PID:940
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:1340
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵PID:2104
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:2196
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵PID:2360
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵PID:2432
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:2612
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵PID:2700
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2744
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2752
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2760
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2768
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2776
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2784
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2792
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2800
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2808
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2816
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵PID:2836
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵PID:2996
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵PID:1188
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵PID:2056
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵PID:2252
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵PID:688
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵PID:2264
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
PID:2344 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵PID:2656
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2768
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2776
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2784
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2792
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2800
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2808
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2816
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2740
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2620
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2628
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2496
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2504
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2564
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2484
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵PID:2844
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵PID:2992
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:2928