Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
16/07/2020, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe
- Size 319KB
- Sample200716-y323whyxss
- SHA256 bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7
- MD5 80bc493320984ff93bab6866eaf0fd2e
- SHA1 09deeb57240711b9fcf33d0b154c9ffd0e0984b1
- SHA512 c4964303911f138217f33ebd9f4367209775b0fba48d6937f5ee30c4855a66d6452d648b392fe4763df9b94474802132fed3d5c5e07365767f14ebadb15c22ce
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3884 evt.exe 3496 evt.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3496 evt.exe Token: SeDebugPrivilege 3496 evt.exe Token: SeDebugPrivilege 740 svchost.exe Token: SeTcbPrivilege 740 svchost.exe Token: SeDebugPrivilege 1844 wmplayer.exe Token: SeTcbPrivilege 1844 wmplayer.exe Token: SeDebugPrivilege 556 wmplayer.exe Token: SeTcbPrivilege 556 wmplayer.exe - Suspicious use of SetWindowsHookEx 1357 IoCs
pid Process 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WerFault.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WerFault.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WerFault.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 wmplayer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ wmplayer.exe - Drops file in Windows directory 40 IoCs
description ioc Process File created C:\Windows\INF\termkbd.PNF WerFault.exe File created C:\Windows\INF\megasr.PNF WerFault.exe File created C:\Windows\INF\percsas2i.PNF WerFault.exe File created C:\Windows\INF\sdbus.PNF WerFault.exe File created C:\Windows\INF\sisraid2.PNF WerFault.exe File created C:\Windows\INF\wsynth3dvsc.PNF WerFault.exe File created C:\Windows\INF\3ware.PNF WerFault.exe File created C:\Windows\INF\ipmidrv.PNF WerFault.exe File created C:\Windows\INF\vsmraid.PNF WerFault.exe File created C:\Windows\INF\lsi_sas.PNF WerFault.exe File created C:\Windows\INF\megasas.PNF WerFault.exe File created C:\Windows\INF\nvraid.PNF WerFault.exe File created C:\Windows\INF\stexstor.PNF WerFault.exe File created C:\Windows\INF\adp80xx.PNF WerFault.exe File created C:\Windows\INF\whyperkbd.PNF WerFault.exe File created C:\Windows\INF\percsas3i.PNF WerFault.exe File created C:\Windows\INF\netvwifibus.PNF WerFault.exe File created C:\Windows\INF\lsi_sas3i.PNF WerFault.exe File created C:\Windows\INF\pcmcia.PNF WerFault.exe File created C:\Windows\INF\wnetvsc.PNF WerFault.exe File created C:\Windows\INF\wstorvsc.PNF WerFault.exe File created C:\Windows\INF\amdsbs.PNF WerFault.exe File created C:\Windows\INF\netrasa.PNF WerFault.exe File created C:\Windows\INF\ws3cap.PNF WerFault.exe File created C:\Windows\INF\sisraid4.PNF WerFault.exe File created C:\Windows\INF\tsusbhub.PNF WerFault.exe File created C:\Windows\INF\hpsamd.PNF WerFault.exe File created C:\Windows\INF\megasas2i.PNF WerFault.exe File created C:\Windows\INF\hidbthle.PNF WerFault.exe File created C:\Windows\INF\mvumis.PNF WerFault.exe File created C:\Windows\LiveKernelReports\NDIS\NDIS-20200716-1414.dmp WerFault.exe File created C:\Windows\INF\bthspp.PNF WerFault.exe File created C:\Windows\INF\vhdmp.PNF WerFault.exe File created C:\Windows\INF\amdsata.PNF WerFault.exe File created C:\Windows\INF\lsi_sss.PNF WerFault.exe File created C:\Windows\INF\lsi_sas2i.PNF WerFault.exe File created C:\Windows\INF\netsstpa.PNF WerFault.exe File created C:\Windows\INF\wvmbushid.PNF WerFault.exe File created C:\Windows\INF\cht4sx64.PNF WerFault.exe File created C:\Windows\INF\wdmvsc.PNF WerFault.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3728 wrote to memory of 3884 3728 bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe 67 PID 3728 wrote to memory of 3884 3728 bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe 67 PID 3728 wrote to memory of 3884 3728 bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe 67 PID 3496 wrote to memory of 740 3496 evt.exe 69 PID 3496 wrote to memory of 740 3496 evt.exe 69 PID 3496 wrote to memory of 740 3496 evt.exe 69 PID 3496 wrote to memory of 740 3496 evt.exe 69 PID 740 wrote to memory of 1844 740 svchost.exe 70 PID 740 wrote to memory of 1844 740 svchost.exe 70 PID 740 wrote to memory of 1844 740 svchost.exe 70 PID 740 wrote to memory of 1844 740 svchost.exe 70 PID 740 wrote to memory of 1844 740 svchost.exe 70 PID 1844 wrote to memory of 556 1844 wmplayer.exe 71 PID 1844 wrote to memory of 556 1844 wmplayer.exe 71 PID 1844 wrote to memory of 556 1844 wmplayer.exe 71 PID 1844 wrote to memory of 556 1844 wmplayer.exe 71 PID 1844 wrote to memory of 556 1844 wmplayer.exe 71 - Executes dropped EXE 2 IoCs
pid Process 3884 evt.exe 3496 evt.exe - Suspicious behavior: EnumeratesProcesses 330 IoCs
pid Process 3496 evt.exe 3496 evt.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 556 wmplayer.exe 1844 wmplayer.exe 1844 wmplayer.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 740 svchost.exe 1844 wmplayer.exe 556 wmplayer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\ntkrnlmp.pdb WerFault.exe File opened for modification C:\Windows\System32\ndis.pdb WerFault.exe - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 WerFault.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID WerFault.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe"C:\Users\Admin\AppData\Local\Temp\bb14728459929940d4a7c6fd636177faacc0a23e4f75e526f12259e78a3853e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\evt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\evt.exe"2⤵
- Loads dropped DLL
- Executes dropped EXE
PID:3884
-
-
C:\ProgramData\EventSetting\evt.exeC:\ProgramData\EventSetting\evt.exe1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3496 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:740 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1844 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:556
-
-
-
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc NDIS NDIS-20200716-1414.dmp1⤵
- Modifies data under HKEY_USERS
- Drops file in Windows directory
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3624