Analysis
- max time kernel
149s - max time network
142s - platform
windows7_x64 - resource
win7v200430 - submitted
20/07/2020, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
data.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target data.exe
- Size 679KB
- Sample200720-epf884ahvs
- SHA256 8043fce8f83dc87396532c20107397ebf5889f802cb588d26bbf0822b39ed27a
- MD5 67ef1442471f759cb626ccaae6199f20
- SHA1 078497fc8e6e89e36b7e16e882054a5924bd4196
- SHA512 9ef9cbcd8619cbb2183d0682b75a76de672d1867dfadf9479c5b8d3e6b9c429124a6bda410f49f39bf026681da7081753c25c90b155ea3aad38d0ce6b704a8d3
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://madibalohilalamb.duckdns.org/Panel/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1872 ieinstal.exe Token: SeDebugPrivilege 556 ieinstal.exe Token: SeDebugPrivilege 880 qldv.exe Token: SeDebugPrivilege 1048 ddjz.exe Token: SeDebugPrivilege 1912 uyby.exe Token: SeDebugPrivilege 1424 msiexec.exe Token: SeDebugPrivilege 1544 RegSvcs.exe Token: SeDebugPrivilege 1964 ieinstal.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ieinstal.exe - Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 1528 set thread context of 760 1528 data.exe 28 PID 1916 set thread context of 304 1916 burm.exe 37 PID 1632 set thread context of 1872 1632 utbi.exe 38 PID 1560 set thread context of 1964 1560 rlzw.exe 39 PID 1872 set thread context of 1316 1872 ieinstal.exe 20 PID 1872 set thread context of 1316 1872 ieinstal.exe 20 PID 304 set thread context of 1456 304 ieinstal.exe 41 PID 304 set thread context of 556 304 ieinstal.exe 42 PID 304 set thread context of 1160 304 ieinstal.exe 43 PID 2016 set thread context of 1480 2016 eisb.exe 50 PID 1912 set thread context of 1832 1912 uyby.exe 55 PID 1048 set thread context of 1544 1048 ddjz.exe 54 PID 1424 set thread context of 1316 1424 msiexec.exe 20 - Executes dropped EXE 13 IoCs
pid Process 1632 utbi.exe 1560 rlzw.exe 1916 burm.exe 1912 uyby.exe 2016 eisb.exe 880 qldv.exe 1048 ddjz.exe 1472 qldv.exe 1588 qldv.exe 1624 qldv.exe 1620 qldv.exe 696 qldv.exe 1480 eisb.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1872 ieinstal.exe 1872 ieinstal.exe 1872 ieinstal.exe 1872 ieinstal.exe 1424 msiexec.exe 1424 msiexec.exe 1424 msiexec.exe 1424 msiexec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1480 eisb.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 456 schtasks.exe 1900 schtasks.exe - Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 760 ieinstal.exe 304 ieinstal.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fmrd = "C:\\Users\\Admin\\AppData\\Local\\fmrd\\fmrd.hta" utbi.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rmrd = "C:\\Users\\Admin\\AppData\\Local\\rmrd\\rmrd.hta" burm.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dbrd = "C:\\Users\\Admin\\AppData\\Local\\dbrd\\dbrd.hta" rlzw.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\eisb.exe" eisb.exe - Loads dropped DLL 14 IoCs
pid Process 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe 760 ieinstal.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1872 ieinstal.exe 1872 ieinstal.exe 1872 ieinstal.exe 1456 ieinstal.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 880 qldv.exe 1456 ieinstal.exe 1912 uyby.exe 1424 msiexec.exe 1424 msiexec.exe 1544 RegSvcs.exe 1544 RegSvcs.exe 1424 msiexec.exe 1424 msiexec.exe 1424 msiexec.exe 1424 msiexec.exe -
description ioc Process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe - Suspicious use of WriteProcessMemory 173 IoCs
description pid Process procid_target PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 1528 wrote to memory of 760 1528 data.exe 28 PID 760 wrote to memory of 1632 760 ieinstal.exe 30 PID 760 wrote to memory of 1632 760 ieinstal.exe 30 PID 760 wrote to memory of 1632 760 ieinstal.exe 30 PID 760 wrote to memory of 1632 760 ieinstal.exe 30 PID 760 wrote to memory of 1560 760 ieinstal.exe 31 PID 760 wrote to memory of 1560 760 ieinstal.exe 31 PID 760 wrote to memory of 1560 760 ieinstal.exe 31 PID 760 wrote to memory of 1560 760 ieinstal.exe 31 PID 760 wrote to memory of 1916 760 ieinstal.exe 32 PID 760 wrote to memory of 1916 760 ieinstal.exe 32 PID 760 wrote to memory of 1916 760 ieinstal.exe 32 PID 760 wrote to memory of 1916 760 ieinstal.exe 32 PID 760 wrote to memory of 1912 760 ieinstal.exe 33 PID 760 wrote to memory of 1912 760 ieinstal.exe 33 PID 760 wrote to memory of 1912 760 ieinstal.exe 33 PID 760 wrote to memory of 1912 760 ieinstal.exe 33 PID 760 wrote to memory of 2016 760 ieinstal.exe 34 PID 760 wrote to memory of 2016 760 ieinstal.exe 34 PID 760 wrote to memory of 2016 760 ieinstal.exe 34 PID 760 wrote to memory of 2016 760 ieinstal.exe 34 PID 760 wrote to memory of 880 760 ieinstal.exe 35 PID 760 wrote to memory of 880 760 ieinstal.exe 35 PID 760 wrote to memory of 880 760 ieinstal.exe 35 PID 760 wrote to memory of 880 760 ieinstal.exe 35 PID 760 wrote to memory of 1048 760 ieinstal.exe 36 PID 760 wrote to memory of 1048 760 ieinstal.exe 36 PID 760 wrote to memory of 1048 760 ieinstal.exe 36 PID 760 wrote to memory of 1048 760 ieinstal.exe 36 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1916 wrote to memory of 304 1916 burm.exe 37 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1632 wrote to memory of 1872 1632 utbi.exe 38 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1560 wrote to memory of 1964 1560 rlzw.exe 39 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 1316 wrote to memory of 1424 1316 Explorer.EXE 40 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 1456 304 ieinstal.exe 41 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 556 304 ieinstal.exe 42 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 304 wrote to memory of 1160 304 ieinstal.exe 43 PID 880 wrote to memory of 1472 880 qldv.exe 44 PID 880 wrote to memory of 1472 880 qldv.exe 44 PID 880 wrote to memory of 1472 880 qldv.exe 44 PID 880 wrote to memory of 1472 880 qldv.exe 44 PID 880 wrote to memory of 1588 880 qldv.exe 45 PID 880 wrote to memory of 1588 880 qldv.exe 45 PID 880 wrote to memory of 1588 880 qldv.exe 45 PID 880 wrote to memory of 1588 880 qldv.exe 45 PID 880 wrote to memory of 1620 880 qldv.exe 46 PID 880 wrote to memory of 1620 880 qldv.exe 46 PID 880 wrote to memory of 1620 880 qldv.exe 46 PID 880 wrote to memory of 1620 880 qldv.exe 46 PID 880 wrote to memory of 1624 880 qldv.exe 47 PID 880 wrote to memory of 1624 880 qldv.exe 47 PID 880 wrote to memory of 1624 880 qldv.exe 47 PID 880 wrote to memory of 1624 880 qldv.exe 47 PID 880 wrote to memory of 696 880 qldv.exe 48 PID 880 wrote to memory of 696 880 qldv.exe 48 PID 880 wrote to memory of 696 880 qldv.exe 48 PID 880 wrote to memory of 696 880 qldv.exe 48 PID 1048 wrote to memory of 1900 1048 ddjz.exe 49 PID 1048 wrote to memory of 1900 1048 ddjz.exe 49 PID 1048 wrote to memory of 1900 1048 ddjz.exe 49 PID 1048 wrote to memory of 1900 1048 ddjz.exe 49 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 2016 wrote to memory of 1480 2016 eisb.exe 50 PID 1912 wrote to memory of 456 1912 uyby.exe 52 PID 1912 wrote to memory of 456 1912 uyby.exe 52 PID 1912 wrote to memory of 456 1912 uyby.exe 52 PID 1912 wrote to memory of 456 1912 uyby.exe 52 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1912 wrote to memory of 1832 1912 uyby.exe 55 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1048 wrote to memory of 1544 1048 ddjz.exe 54 PID 1424 wrote to memory of 1592 1424 msiexec.exe 57 PID 1424 wrote to memory of 1592 1424 msiexec.exe 57 PID 1424 wrote to memory of 1592 1424 msiexec.exe 57 PID 1424 wrote to memory of 1592 1424 msiexec.exe 57 PID 1424 wrote to memory of 1592 1424 msiexec.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\data.exe"C:\Users\Admin\AppData\Local\Temp\data.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Roaming\utbi.exe"C:\Users\Admin\AppData\Roaming\utbi.exe" 04⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
-
C:\Users\Admin\AppData\Roaming\rlzw.exe"C:\Users\Admin\AppData\Roaming\rlzw.exe" 04⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\Users\Admin\AppData\Roaming\burm.exe"C:\Users\Admin\AppData\Roaming\burm.exe" 04⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hgynr"6⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\silfrvms"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ucrysgxufjf"6⤵PID:1160
-
-
-
-
C:\Users\Admin\AppData\Roaming\uyby.exe"C:\Users\Admin\AppData\Roaming\uyby.exe" 04⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RVQwOvPQSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp61DD.tmp"5⤵
- Creates scheduled task(s)
PID:456
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"5⤵PID:1832
-
-
-
C:\Users\Admin\AppData\Roaming\eisb.exe"C:\Users\Admin\AppData\Roaming\eisb.exe" 04⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Roaming\eisb.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Adds Run key to start application
PID:1480
-
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"C:\Users\Admin\AppData\Roaming\qldv.exe" 04⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\Users\Admin\AppData\Roaming\qldv.exe"{path}"5⤵
- Executes dropped EXE
PID:1472
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"{path}"5⤵
- Executes dropped EXE
PID:1588
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"{path}"5⤵
- Executes dropped EXE
PID:1620
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"{path}"5⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"{path}"5⤵
- Executes dropped EXE
PID:696
-
-
-
C:\Users\Admin\AppData\Roaming\ddjz.exe"C:\Users\Admin\AppData\Roaming\ddjz.exe" 04⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1048 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnkeDqfnzxjKg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6096.tmp"5⤵
- Creates scheduled task(s)
PID:1900
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
-
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
PID:1424 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1592
-
-