Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
29/07/2020, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe
Resource
win10v200722
General
-
Target
47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe
-
Size
460KB
-
MD5
4b77629ce08bbc175faceb45abe68a45
-
SHA1
8d2e45397806e5b4e20bf9f0cf80eeffdbc9af1d
-
SHA256
47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9
-
SHA512
8c8e410bb918d4a124b5f39ba5df7aedc98207f3c50851d35f6d0a611ebd2c29fc9372d58e59d99ed5d65db28d28391f38a44d42e4eccea23d6563e94bda0dbb
Malware Config
Extracted
C:\Users\Admin\Desktop\!HELP_SOS.hta
http://7gie6ffnkrjykggd.qlkrwn.com/
http://7gie6ffnkrjykggd.xcvkjet.net/
http://7gie6ffnkrjykggd.onion/login/AZNNWHs-cNYnVkRZL8XMh3vczNZWYuBMh6cIQg0wNa3rNHdudTAKK3nA
http://7gie6ffnkrjykggd.onion/login/AZNNWHs-cNYnVkRZL8XMh3vczNZWYuBMh6cIQg0wNa3rNHdudTAKK3nA到浏览器的地址栏,然后按下"回车"键;
Signatures
-
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\.sage 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\FriendlyTypeName 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\shell\open\command 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\shell\open 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\.sage\ = "sage.notice" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\htafile\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,44" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\DefaultIcon 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\DefaultIcon\ = "%WinDir%\\SysWow64\\shell32.dll,47" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\FriendlyTypeName\ = "encrypted by SAGE" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\shell 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\sage.notice\shell\open\command\ = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\f1.hta\" \"%1\"" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\htafile\DefaultIcon 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\htafile 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2052 vssadmin.exe 792 vssadmin.exe 2708 vssadmin.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of WriteProcessMemory 114 IoCs
description pid Process procid_target PID 3924 wrote to memory of 3548 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 66 PID 3924 wrote to memory of 3548 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 66 PID 3924 wrote to memory of 3548 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 66 PID 3924 wrote to memory of 3096 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 67 PID 3924 wrote to memory of 3096 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 67 PID 3924 wrote to memory of 3096 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 67 PID 3924 wrote to memory of 812 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 69 PID 3924 wrote to memory of 812 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 69 PID 3924 wrote to memory of 812 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 69 PID 3924 wrote to memory of 496 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 70 PID 3924 wrote to memory of 496 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 70 PID 3924 wrote to memory of 496 3924 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 70 PID 3548 wrote to memory of 1224 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 71 PID 3548 wrote to memory of 1224 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 71 PID 3548 wrote to memory of 1224 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 71 PID 3548 wrote to memory of 1460 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 72 PID 3548 wrote to memory of 1460 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 72 PID 3548 wrote to memory of 1460 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 72 PID 812 wrote to memory of 1744 812 Rj3fNWF3.exe 74 PID 812 wrote to memory of 1744 812 Rj3fNWF3.exe 74 PID 812 wrote to memory of 1744 812 Rj3fNWF3.exe 74 PID 3548 wrote to memory of 2052 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 75 PID 3548 wrote to memory of 2052 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 75 PID 3548 wrote to memory of 2052 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 75 PID 1744 wrote to memory of 2440 1744 Rj3fNWF3.exe 77 PID 1744 wrote to memory of 2440 1744 Rj3fNWF3.exe 77 PID 1744 wrote to memory of 2440 1744 Rj3fNWF3.exe 77 PID 3548 wrote to memory of 792 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 80 PID 3548 wrote to memory of 792 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 80 PID 3548 wrote to memory of 792 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 80 PID 2440 wrote to memory of 2228 2440 Rj3fNWF3.exe 82 PID 2440 wrote to memory of 2228 2440 Rj3fNWF3.exe 82 PID 2440 wrote to memory of 2228 2440 Rj3fNWF3.exe 82 PID 3548 wrote to memory of 2708 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 84 PID 3548 wrote to memory of 2708 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 84 PID 3548 wrote to memory of 2708 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 84 PID 3548 wrote to memory of 3980 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 87 PID 3548 wrote to memory of 3980 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 87 PID 3548 wrote to memory of 3980 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 87 PID 2228 wrote to memory of 852 2228 Rj3fNWF3.exe 88 PID 2228 wrote to memory of 852 2228 Rj3fNWF3.exe 88 PID 2228 wrote to memory of 852 2228 Rj3fNWF3.exe 88 PID 3548 wrote to memory of 1012 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 89 PID 3548 wrote to memory of 1012 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 89 PID 3548 wrote to memory of 1012 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 89 PID 852 wrote to memory of 2436 852 Rj3fNWF3.exe 92 PID 852 wrote to memory of 2436 852 Rj3fNWF3.exe 92 PID 852 wrote to memory of 2436 852 Rj3fNWF3.exe 92 PID 2436 wrote to memory of 1232 2436 Rj3fNWF3.exe 93 PID 2436 wrote to memory of 1232 2436 Rj3fNWF3.exe 93 PID 2436 wrote to memory of 1232 2436 Rj3fNWF3.exe 93 PID 1232 wrote to memory of 3960 1232 Rj3fNWF3.exe 97 PID 1232 wrote to memory of 3960 1232 Rj3fNWF3.exe 97 PID 1232 wrote to memory of 3960 1232 Rj3fNWF3.exe 97 PID 3960 wrote to memory of 3412 3960 Rj3fNWF3.exe 98 PID 3960 wrote to memory of 3412 3960 Rj3fNWF3.exe 98 PID 3960 wrote to memory of 3412 3960 Rj3fNWF3.exe 98 PID 3412 wrote to memory of 852 3412 Rj3fNWF3.exe 99 PID 3412 wrote to memory of 852 3412 Rj3fNWF3.exe 99 PID 3412 wrote to memory of 852 3412 Rj3fNWF3.exe 99 PID 852 wrote to memory of 3848 852 Rj3fNWF3.exe 100 PID 852 wrote to memory of 3848 852 Rj3fNWF3.exe 100 PID 852 wrote to memory of 3848 852 Rj3fNWF3.exe 100 PID 3848 wrote to memory of 3124 3848 Rj3fNWF3.exe 101 PID 3848 wrote to memory of 3124 3848 Rj3fNWF3.exe 101 PID 3848 wrote to memory of 3124 3848 Rj3fNWF3.exe 101 PID 3124 wrote to memory of 3300 3124 Rj3fNWF3.exe 102 PID 3124 wrote to memory of 3300 3124 Rj3fNWF3.exe 102 PID 3124 wrote to memory of 3300 3124 Rj3fNWF3.exe 102 PID 3300 wrote to memory of 1520 3300 Rj3fNWF3.exe 103 PID 3300 wrote to memory of 1520 3300 Rj3fNWF3.exe 103 PID 3300 wrote to memory of 1520 3300 Rj3fNWF3.exe 103 PID 1520 wrote to memory of 2304 1520 Rj3fNWF3.exe 104 PID 1520 wrote to memory of 2304 1520 Rj3fNWF3.exe 104 PID 1520 wrote to memory of 2304 1520 Rj3fNWF3.exe 104 PID 2304 wrote to memory of 3508 2304 Rj3fNWF3.exe 105 PID 2304 wrote to memory of 3508 2304 Rj3fNWF3.exe 105 PID 2304 wrote to memory of 3508 2304 Rj3fNWF3.exe 105 PID 3508 wrote to memory of 1448 3508 Rj3fNWF3.exe 106 PID 3508 wrote to memory of 1448 3508 Rj3fNWF3.exe 106 PID 3508 wrote to memory of 1448 3508 Rj3fNWF3.exe 106 PID 1448 wrote to memory of 1824 1448 Rj3fNWF3.exe 107 PID 1448 wrote to memory of 1824 1448 Rj3fNWF3.exe 107 PID 1448 wrote to memory of 1824 1448 Rj3fNWF3.exe 107 PID 1824 wrote to memory of 3412 1824 Rj3fNWF3.exe 108 PID 1824 wrote to memory of 3412 1824 Rj3fNWF3.exe 108 PID 1824 wrote to memory of 3412 1824 Rj3fNWF3.exe 108 PID 3412 wrote to memory of 3812 3412 Rj3fNWF3.exe 109 PID 3412 wrote to memory of 3812 3412 Rj3fNWF3.exe 109 PID 3412 wrote to memory of 3812 3412 Rj3fNWF3.exe 109 PID 3812 wrote to memory of 3860 3812 Rj3fNWF3.exe 110 PID 3812 wrote to memory of 3860 3812 Rj3fNWF3.exe 110 PID 3812 wrote to memory of 3860 3812 Rj3fNWF3.exe 110 PID 3860 wrote to memory of 2632 3860 Rj3fNWF3.exe 111 PID 3860 wrote to memory of 2632 3860 Rj3fNWF3.exe 111 PID 3860 wrote to memory of 2632 3860 Rj3fNWF3.exe 111 PID 2632 wrote to memory of 3604 2632 Rj3fNWF3.exe 112 PID 2632 wrote to memory of 3604 2632 Rj3fNWF3.exe 112 PID 2632 wrote to memory of 3604 2632 Rj3fNWF3.exe 112 PID 3604 wrote to memory of 768 3604 Rj3fNWF3.exe 113 PID 3604 wrote to memory of 768 3604 Rj3fNWF3.exe 113 PID 3604 wrote to memory of 768 3604 Rj3fNWF3.exe 113 PID 768 wrote to memory of 764 768 Rj3fNWF3.exe 114 PID 768 wrote to memory of 764 768 Rj3fNWF3.exe 114 PID 768 wrote to memory of 764 768 Rj3fNWF3.exe 114 PID 764 wrote to memory of 3472 764 Rj3fNWF3.exe 115 PID 764 wrote to memory of 3472 764 Rj3fNWF3.exe 115 PID 764 wrote to memory of 3472 764 Rj3fNWF3.exe 115 PID 3472 wrote to memory of 2320 3472 Rj3fNWF3.exe 116 PID 3472 wrote to memory of 2320 3472 Rj3fNWF3.exe 116 PID 3472 wrote to memory of 2320 3472 Rj3fNWF3.exe 116 PID 2320 wrote to memory of 2392 2320 Rj3fNWF3.exe 117 PID 2320 wrote to memory of 2392 2320 Rj3fNWF3.exe 117 PID 2320 wrote to memory of 2392 2320 Rj3fNWF3.exe 117 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3096 schtasks.exe 1460 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2656 vssvc.exe Token: SeRestorePrivilege 2656 vssvc.exe Token: SeAuditPrivilege 2656 vssvc.exe -
JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000200000001acd1-36.dat js -
Executes dropped EXE 28 IoCs
pid Process 812 Rj3fNWF3.exe 1744 Rj3fNWF3.exe 2440 Rj3fNWF3.exe 2228 Rj3fNWF3.exe 852 Rj3fNWF3.exe 2436 Rj3fNWF3.exe 1232 Rj3fNWF3.exe 3960 Rj3fNWF3.exe 3412 Rj3fNWF3.exe 852 Rj3fNWF3.exe 3848 Rj3fNWF3.exe 3124 Rj3fNWF3.exe 3300 Rj3fNWF3.exe 1520 Rj3fNWF3.exe 2304 Rj3fNWF3.exe 3508 Rj3fNWF3.exe 1448 Rj3fNWF3.exe 1824 Rj3fNWF3.exe 3412 Rj3fNWF3.exe 3812 Rj3fNWF3.exe 3860 Rj3fNWF3.exe 2632 Rj3fNWF3.exe 3604 Rj3fNWF3.exe 768 Rj3fNWF3.exe 764 Rj3fNWF3.exe 3472 Rj3fNWF3.exe 2320 Rj3fNWF3.exe 2392 Rj3fNWF3.exe -
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-19 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Key created \REGISTRY\USER\S-1-5-20 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DDx.bmp" 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Desktop\Wallpaper 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe 3548 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\WriteConfirm.raw... 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe File renamed C:\Users\Admin\Pictures\WriteConfirm.raw... => C:\Users\Admin\Pictures\WriteConfirm.raw.sage 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe File opened for modification C:\Users\Admin\Pictures\SetMerge.tiff 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe File created C:\Users\Admin\Pictures\SetMerge.tiff... 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe File renamed C:\Users\Admin\Pictures\SetMerge.tiff... => C:\Users\Admin\Pictures\SetMerge.tiff.sage 47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe"C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe"C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe" g2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Modifies extensions of user files
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe"C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe" g3⤵PID:1224
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Local\Temp\47e9841c99f3e198a715263f76861e997d807a085ce69c6288bfe97227242ed9.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- Creates scheduled task(s)
PID:1460
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2052
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:792
-
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2708
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:3980
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"3⤵PID:1012
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- Creates scheduled task(s)
PID:3096
-
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g6⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g7⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g8⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g9⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g10⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g11⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g12⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g13⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g14⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g15⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g16⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g17⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g18⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g19⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g20⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g21⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g22⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g23⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g24⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g25⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g26⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g27⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g28⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g29⤵
- Executes dropped EXE
PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"2⤵PID:496
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2656