Analysis

  • max time kernel
    151s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    22/07/2020, 06:14

General

  • Target
    Revised P.I Officina_images.exe
  • Size 369KB
  • Sample200722-75ndvyhszn
  • SHA256 f15d580cc1e0b17070f7fe48cb8d8a60177e4e8468d5b5f2008e6be5c3a85b42
  • MD5 SHA1 SHA512
Score
7/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 459 IoCs
  • Suspicious behavior: MapViewOfSection 42 IoCs
  • Suspicious use of SetThreadContext 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 12201 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Drops startup file 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Drops startup file
    PID:1252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Adds Run key to start application
      PID:1400
    • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
      "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Drops startup file
      PID:1012
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:240
        • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
          "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:1548
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:1812
            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1756
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                • Adds Run key to start application
                PID:820
              • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:1600
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:1908
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:1884
                    • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                      "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                      6⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1944
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                          PID:1736
                        • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                          "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                          7⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1608
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            8⤵
                              PID:1768
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              8⤵
                              • Suspicious use of AdjustPrivilegeToken
                              • Adds Run key to start application
                              PID:1084
                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                              8⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1808
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                9⤵
                                  PID:1540
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  9⤵
                                    PID:1900
                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                    9⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1904
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      10⤵
                                        PID:1336
                                      • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                        10⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:524
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          11⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Adds Run key to start application
                                          PID:308
                                        • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                          11⤵
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1872
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            12⤵
                                              PID:1716
                                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                              12⤵
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1648
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                13⤵
                                                  PID:1948
                                                • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                  13⤵
                                                  • Suspicious behavior: MapViewOfSection
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1776
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    14⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Adds Run key to start application
                                                    PID:1756
                                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                    14⤵
                                                    • Suspicious behavior: MapViewOfSection
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1744
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      15⤵
                                                        PID:676
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        15⤵
                                                          PID:1336
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          15⤵
                                                            PID:360
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            15⤵
                                                              PID:792
                                                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                              15⤵
                                                              • Suspicious behavior: MapViewOfSection
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:816
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                16⤵
                                                                  PID:1908
                                                                • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                  16⤵
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1104
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    17⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Adds Run key to start application
                                                                    PID:1944
                                                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                    17⤵
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1836
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      18⤵
                                                                        PID:620
                                                                      • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                        18⤵
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1920
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          19⤵
                                                                            PID:644
                                                                          • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                            19⤵
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1356
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              20⤵
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Adds Run key to start application
                                                                              PID:1772
                                                                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                              20⤵
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1776
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                21⤵
                                                                                  PID:852
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  21⤵
                                                                                    PID:1672
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                    21⤵
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:820
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                      22⤵
                                                                                        PID:1980
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                        22⤵
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1100
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                          23⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Adds Run key to start application
                                                                                          PID:1516
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                          23⤵
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1104
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                            24⤵
                                                                                              PID:568
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                              24⤵
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1868
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                25⤵
                                                                                                  PID:1812
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                  25⤵
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1876
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    26⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Adds Run key to start application
                                                                                                    PID:1792
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                    26⤵
                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1648
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      27⤵
                                                                                                        PID:364
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                        27⤵
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1552
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          28⤵
                                                                                                            PID:1672
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                            28⤵
                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1776
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                              29⤵
                                                                                                                PID:1364
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                29⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Adds Run key to start application
                                                                                                                PID:1744
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                29⤵
                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:844
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  30⤵
                                                                                                                    PID:1124
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                    30⤵
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1240
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      31⤵
                                                                                                                        PID:1096
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                        31⤵
                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1436
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          32⤵
                                                                                                                            PID:672
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            32⤵
                                                                                                                              PID:1768
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                              32⤵
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:948
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                33⤵
                                                                                                                                  PID:1952
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                                  33⤵
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:752
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    34⤵
                                                                                                                                      PID:1748
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Revised P.I Officina_images.exe"
                                                                                                                                      34⤵
                                                                                                                                        PID:2000

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v6

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          memory/1400-2-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                          memory/1400-3-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                          memory/1400-0-0x0000000000400000-0x000000000044C000-memory.dmp