Analysis
-
max time kernel
150s -
max time network
68s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
24-09-2020 12:05
Static task
static1
Behavioral task
behavioral1
Sample
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0.ps1
Resource
win7
Behavioral task
behavioral2
Sample
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0.ps1
Resource
win10v200722
General
-
Target
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0.ps1
-
Size
902KB
-
MD5
49b3ed4c73d8d5a6613b725d40172590
-
SHA1
07e30496992d7087674cf5542c78856f66ff7737
-
SHA256
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0
-
SHA512
026c0a58a56747cbb9efab721382924d6da48c65483325ec868c9c894ff601a0461fa3674f4fa01c570635521cc6e7e8c96efe8765fcf68aa7eb713df988e2a3
Malware Config
Extracted
C:\odt\3C92D9-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\Java\jdk1.8.0_66\3C92D9-Readme.txt
mailto_hamlampampom
Extracted
C:\Users\Admin\Desktop\3C92D9-Readme.txt
mailto_hamlampampom
Extracted
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3C92D9-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\3C92D9-Readme.txt
mailto_hamlampampom
Signatures
-
MailTo (Hamlampampom Variant)
Ransomware family discovered in late 2019 with variants named based on contact emails.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Explorer.EXEdescription ioc process File renamed C:\Users\Admin\Pictures\RemoveLock.png => C:\Users\Admin\Pictures\RemoveLock.png.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\NewLimit.tiff => C:\Users\Admin\Pictures\NewLimit.tiff.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\SelectEnter.tiff => C:\Users\Admin\Pictures\SelectEnter.tiff.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\TraceRemove.tiff => C:\Users\Admin\Pictures\TraceRemove.tiff.3c92d9 Explorer.EXE File opened for modification C:\Users\Admin\Pictures\NewLimit.tiff Explorer.EXE File opened for modification C:\Users\Admin\Pictures\SelectEnter.tiff Explorer.EXE File opened for modification C:\Users\Admin\Pictures\TraceRemove.tiff Explorer.EXE File renamed C:\Users\Admin\Pictures\CompressOut.crw => C:\Users\Admin\Pictures\CompressOut.crw.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\ReadUnpublish.raw => C:\Users\Admin\Pictures\ReadUnpublish.raw.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\DisableSelect.tif => C:\Users\Admin\Pictures\DisableSelect.tif.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\UseShow.tif => C:\Users\Admin\Pictures\UseShow.tif.3c92d9 Explorer.EXE File renamed C:\Users\Admin\Pictures\SplitExpand.crw => C:\Users\Admin\Pictures\SplitExpand.crw.3c92d9 Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 17076 IoCs
Processes:
Explorer.EXEdescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated_contrast-white.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-200.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\eg_60x42.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\All_cards.png Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-200.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-125.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7834_24x24x32.png Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-300.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ag_60x42.png Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\ui-strings.js Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg Explorer.EXE File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\3C92D9-Readme.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\Colored_VS.fxo Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\FreeCell\Goal_6.jpg Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.contrast-white_scale-100.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10910_48x48x32.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\pencilbox.3mf Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat Explorer.EXE File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg Explorer.EXE File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\12s.png Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png Explorer.EXE File created C:\Program Files\Microsoft Office\root\Office16\1033\3C92D9-Readme.txt Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-200.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\en-GB.PhoneNumber.SMS.ot Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_32x32x32.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\jp_60x42.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\pn_60x42.png Explorer.EXE File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png Explorer.EXE File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\CinemagraphDelegate\CinemagraphControl.xaml Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\SmallTile.scale-100.png Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js Explorer.EXE File created C:\Program Files\Java\jre1.8.0_66\lib\jfr\3C92D9-Readme.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.ViewModel.winmd Explorer.EXE File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\3C92D9-Readme.txt Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-64_altform-unplated.png Explorer.EXE File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\bg6.jpg Explorer.EXE File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-100.png Explorer.EXE File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\3C92D9-Readme.txt Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 35870 IoCs
Processes:
powershell.exeExplorer.EXEpid process 2096 powershell.exe 2096 powershell.exe 2096 powershell.exe 2096 powershell.exe 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE 1900 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
powershell.exeExplorer.EXEvssvc.exedescription pid process Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 1900 Explorer.EXE Token: SeImpersonatePrivilege 1900 Explorer.EXE Token: SeBackupPrivilege 3204 vssvc.exe Token: SeRestorePrivilege 3204 vssvc.exe Token: SeAuditPrivilege 3204 vssvc.exe Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE Token: SeShutdownPrivilege 1900 Explorer.EXE Token: SeCreatePagefilePrivilege 1900 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
powershell.execsc.execsc.exeExplorer.EXEdescription pid process target process PID 2096 wrote to memory of 3852 2096 powershell.exe csc.exe PID 2096 wrote to memory of 3852 2096 powershell.exe csc.exe PID 3852 wrote to memory of 3528 3852 csc.exe cvtres.exe PID 3852 wrote to memory of 3528 3852 csc.exe cvtres.exe PID 2096 wrote to memory of 3712 2096 powershell.exe csc.exe PID 2096 wrote to memory of 3712 2096 powershell.exe csc.exe PID 3712 wrote to memory of 3688 3712 csc.exe cvtres.exe PID 3712 wrote to memory of 3688 3712 csc.exe cvtres.exe PID 2096 wrote to memory of 1900 2096 powershell.exe Explorer.EXE PID 1900 wrote to memory of 6628 1900 Explorer.EXE notepad.exe PID 1900 wrote to memory of 6628 1900 Explorer.EXE notepad.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sakqe0jw\sakqe0jw.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DE5.tmp" "c:\Users\Admin\AppData\Local\Temp\sakqe0jw\CSC7BF3AF2E14A46CDB27D99D7697E30C7.TMP"4⤵PID:3528
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\12vnrlkg\12vnrlkg.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES646D.tmp" "c:\Users\Admin\AppData\Local\Temp\12vnrlkg\CSCCAE331416BE4DC3B46F82E76478844.TMP"4⤵PID:3688
-
-
-
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\3C92D9-Readme.txt"2⤵PID:6628
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3204