Analysis
- max time kernel
113s - max time network
137s - platform
windows7_x64 - resource
win7 - submitted
02/08/2020, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
8054fb018918f753e9a6b64f3da5b5c9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 8054fb018918f753e9a6b64f3da5b5c9.exe
- Size 713KB
- Sample200802-bpx9qdabla
- SHA256 620d15d15c20dcc0a6d2d79317160180cd92fc005fc7bbd864a8ba3be34f3635
- MD5 8054fb018918f753e9a6b64f3da5b5c9
- SHA1 9bdfe1731d04c50a8bc33160bcf16800bcb4d622
- SHA512 7118c7b7dce1b6defec6907f9e8dc2c1bc964c32b056cef97b26dc63d62e39a6d190dcdf0d9092ee427360a9f290512f43d8795c0d67b147f9c90e9f1ddfd226
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1428 wotsuper.exe 284 wotsuper1.exe 524 fdf0a483..exe 768 fdf0a483..exe - Loads dropped DLL 11 IoCs
pid Process 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 1428 wotsuper.exe 1428 wotsuper.exe 1428 wotsuper.exe 1428 wotsuper.exe 284 wotsuper1.exe 284 wotsuper1.exe 524 fdf0a483..exe 768 fdf0a483..exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00030000000131dc-17.dat js - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 ip-api.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 524 set thread context of 768 524 fdf0a483..exe 37 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe 8054fb018918f753e9a6b64f3da5b5c9.exe File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe 8054fb018918f753e9a6b64f3da5b5c9.exe File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe 8054fb018918f753e9a6b64f3da5b5c9.exe File created C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini 8054fb018918f753e9a6b64f3da5b5c9.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\wotsuper.reg 8054fb018918f753e9a6b64f3da5b5c9.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wotsuper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wotsuper.exe - Kills process with taskkill 1 IoCs
pid Process 1328 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000ff24ae9468612aaae8a31088059264959ecf6e88c2d6b19b9507dedb4f94d310000000000e8000000002000020000000505618ead2745f13dfd9ce98c0490e6065717e6711423408ced13ac353e4eb58900000005ca766d2dd96aedc6e5be98df58fda8d48ef69b2f0ec1d0b30bebffcb8a5f3813d348eba55e4a2756ef14e1d4842c9f31dfeeae64f4991c84dfed3179c297a5a4cdd239104f2a349bd659e9a664c7c2650daa62abb72bd4a55ba054a3e4b72a47f067cd42353483ee33ed6d693f2dc0bde4baea2bfb9c8d6298b877983959632a5beb4432114124d5cfa43ee53c9a7914000000080ed3f5ad78eef7ee7a950e4c5a8845e16b5cde331a114cc333c709a7661eca6cbc9a291bc07a6a70fdc071f2f1b3333d6cff26927545eb3cdb85d1ee177be24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab80000000002000000000010660000000100002000000007d703c52e02096118dfe64e3173c40d785f24a63c98d33cb96125357694355b000000000e8000000002000020000000091454e58fcc8142abc6e35d9c3747f76d0caf2b7d7b5418e3bf237545368b1a2000000049d47e43b3e7cd0f0d50ea5f0c36b809c7cba03a4913d4cbac060d9d29aadde440000000ef5184ae71a5ef9c15e8505456088852a6325af1f6ce8229ffbca9af5ec1acfa7b81ec718c72538ad188438d0e26de5d16c79e63d78a4293801172445d328769 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803c717bbb68d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "303130688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A436D3A1-D4AE-11EA-A018-EEE7497CF87D} = "0" iexplore.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1" wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 40b40e6fbb68d601 wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 40b40e6fbb68d601 wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77 wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21} wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0" wotsuper1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 wotsuper1.exe - Runs .reg file with regedit 1 IoCs
pid Process 660 regedit.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1296 PING.EXE - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 284 wotsuper1.exe 1428 wotsuper.exe 1428 wotsuper.exe 1428 wotsuper.exe 1428 wotsuper.exe 284 wotsuper1.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1328 taskkill.exe Token: SeDebugPrivilege 284 wotsuper1.exe Token: SeCreateTokenPrivilege 284 wotsuper1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1288 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1288 iexplore.exe 1288 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1288 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 24 PID 1164 wrote to memory of 1288 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 24 PID 1164 wrote to memory of 1288 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 24 PID 1164 wrote to memory of 1288 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 24 PID 1164 wrote to memory of 1428 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 25 PID 1164 wrote to memory of 1428 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 25 PID 1164 wrote to memory of 1428 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 25 PID 1164 wrote to memory of 1428 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 25 PID 1164 wrote to memory of 284 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 26 PID 1164 wrote to memory of 284 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 26 PID 1164 wrote to memory of 284 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 26 PID 1164 wrote to memory of 284 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 26 PID 1164 wrote to memory of 660 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 27 PID 1164 wrote to memory of 660 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 27 PID 1164 wrote to memory of 660 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 27 PID 1164 wrote to memory of 660 1164 8054fb018918f753e9a6b64f3da5b5c9.exe 27 PID 1288 wrote to memory of 1384 1288 iexplore.exe 29 PID 1288 wrote to memory of 1384 1288 iexplore.exe 29 PID 1288 wrote to memory of 1384 1288 iexplore.exe 29 PID 1288 wrote to memory of 1384 1288 iexplore.exe 29 PID 1428 wrote to memory of 1564 1428 wotsuper.exe 32 PID 1428 wrote to memory of 1564 1428 wotsuper.exe 32 PID 1428 wrote to memory of 1564 1428 wotsuper.exe 32 PID 1428 wrote to memory of 1564 1428 wotsuper.exe 32 PID 1564 wrote to memory of 1328 1564 cmd.exe 34 PID 1564 wrote to memory of 1328 1564 cmd.exe 34 PID 1564 wrote to memory of 1328 1564 cmd.exe 34 PID 1564 wrote to memory of 1328 1564 cmd.exe 34 PID 284 wrote to memory of 524 284 wotsuper1.exe 36 PID 284 wrote to memory of 524 284 wotsuper1.exe 36 PID 284 wrote to memory of 524 284 wotsuper1.exe 36 PID 284 wrote to memory of 524 284 wotsuper1.exe 36 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 524 wrote to memory of 768 524 fdf0a483..exe 37 PID 284 wrote to memory of 1388 284 wotsuper1.exe 38 PID 284 wrote to memory of 1388 284 wotsuper1.exe 38 PID 284 wrote to memory of 1388 284 wotsuper1.exe 38 PID 284 wrote to memory of 1388 284 wotsuper1.exe 38 PID 1388 wrote to memory of 1296 1388 cmd.exe 40 PID 1388 wrote to memory of 1296 1388 cmd.exe 40 PID 1388 wrote to memory of 1296 1388 cmd.exe 40 PID 1388 wrote to memory of 1296 1388 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\8054fb018918f753e9a6b64f3da5b5c9.exe"C:\Users\Admin\AppData\Local\Temp\8054fb018918f753e9a6b64f3da5b5c9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/14jK87.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
-
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im wotsuper.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
-
-
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\AppData\Local\Temp\fdf0a483..exe"C:\Users\Admin\AppData\Local\Temp\fdf0a483..exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\fdf0a483..exe"C:\Users\Admin\AppData\Local\Temp\fdf0a483..exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:1296
-
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg2⤵
- Runs .reg file with regedit
PID:660
-