Analysis
-
max time kernel
65s -
max time network
116s -
platform
windows10_x64 -
resource
win10 -
submitted
12-07-2020 08:16
Static task
static1
Behavioral task
behavioral1
Sample
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
-
Size
717KB
-
MD5
de693a0ae0b1cdefbe778a8d8af1cd9d
-
SHA1
bc7fd9e2066415a9939d25c0c9ea2ee29176726a
-
SHA256
6dc5dc06eba82eb3dbfc51c48f44a0b6bc519d2432d357cb84d65cf7b9b4e763
-
SHA512
a82b2dc6aa9b48346c8747db22153249f18c76e45ddbd503144cae6853cb5d7c839839521dc83a6046a9b5e04b1ff81ab46aa7f9d1101a11b5eead6d6c4bba4d
Score
10/10
Malware Config
Extracted
Path
C:\Boot\bg-BG\Read_Me.txt
Ransom Note
Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://7rzpyw3hflwe2c7h.onion/?FWYZBDEG
5. Follow the instructions on this page
----------------------------------------------------------------------------------------
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs
http://7rzpyw3hflwe2c7h.onion/?FWYZBDEG
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription pid process target process PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 2288 wrote to memory of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription pid process target process PID 2288 set thread context of 3900 2288 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious behavior: EnumeratesProcesses 8316 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exepid process 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 3900 de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Drops file in Program Files directory 11249 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2017.125.40.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-white_scale-125.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp8.scale-125.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\PopUp\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\starttile.wink.scale-150.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-200.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Flattener\api-ms-win-core-localization-l1-2-0.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200_contrast-high.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\SystemX64\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeMedTile.scale-125_contrast-black.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\mask\1c.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_SadMouth.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MSTAG.TLB de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Arrow.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\3899_40x40x32.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\animations\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\mcxml\x-none\PowerPoint.x-none.msi.16_mondoww.mcxml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Common.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\7.jpg de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-125_contrast-white.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\en-US\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\Movie-TVStoreLogo.scale-125.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-32.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100_contrast-black.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\ScoreTrophy.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Drops desktop.ini file(s)