d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152

Analysis

max time kernel
88s
max time network
151s
platform
windows10_x64
resource
win10
submitted
14/10/2020, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce56f130c12f75c8b26151d1c3a6de37.exe
Size 287KB
Sample201014-c3ft3a9bys
SHA256 d6d9a32fd696e4980d644f655563379ba7b04a2e3db03bbe6fbfb894fa68b152
MD5 ce56f130c12f75c8b26151d1c3a6de37
SHA1 88bcd8e12bc6c7d9fee6948ae1923b4d8a9c0e62
SHA512 ee185e6fb318ec0299267badac66b18377baa51a39b03c76a1757113622047ff2cd55bac188e72dc9e02c40156fcd8f3a43e7f00aae5b3c088d2bc315ecf36d4
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1520-7-0x000000000040616E-mapping.dmp	disable_win_def
behavioral2/memory/1520-6-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/files/0x000200000001ad98-26.dat	disable_win_def
behavioral2/files/0x000200000001ad98-27.dat	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Executes dropped EXE 1 IoCs

pid	Process
3224	3hnrkr1a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76

Kills process with taskkill 1 IoCs

evasion

pid	Process
3756	taskkill.exe

Suspicious behavior: EnumeratesProcesses 411 IoCs

pid	Process
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
1632	powershell.exe
2152	powershell.exe
2152	powershell.exe
2776	powershell.exe
2776	powershell.exe
1996	powershell.exe
1996	powershell.exe
4100	powershell.exe
4100	powershell.exe
352	powershell.exe
352	powershell.exe
4200	powershell.exe
4200	powershell.exe
1992	powershell.exe
1992	powershell.exe
4100	powershell.exe
4200	powershell.exe
4312	powershell.exe
4312	powershell.exe
4432	powershell.exe
4432	powershell.exe
1632	powershell.exe
1632	powershell.exe
2776	powershell.exe
2776	powershell.exe
1996	powershell.exe
4100	powershell.exe
2152	powershell.exe
2152	powershell.exe
4536	powershell.exe
4536	powershell.exe
4432	powershell.exe
4652	powershell.exe
4652	powershell.exe
352	powershell.exe
4200	powershell.exe
1992	powershell.exe
1632	powershell.exe
2776	powershell.exe
1996	powershell.exe
1996	powershell.exe
4432	powershell.exe
2152	powershell.exe
352	powershell.exe
4312	powershell.exe
1992	powershell.exe
4536	powershell.exe
4652	powershell.exe
4312	powershell.exe
4536	powershell.exe
4652	powershell.exe

Suspicious use of AdjustPrivilegeToken 289 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	ce56f130c12f75c8b26151d1c3a6de37.exe
Token: SeDebugPrivilege	1520	ce56f130c12f75c8b26151d1c3a6de37.exe
Token: SeDebugPrivilege	3756	taskkill.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeIncreaseQuotaPrivilege	3692	powershell.exe
Token: SeSecurityPrivilege	3692	powershell.exe
Token: SeTakeOwnershipPrivilege	3692	powershell.exe
Token: SeLoadDriverPrivilege	3692	powershell.exe
Token: SeSystemProfilePrivilege	3692	powershell.exe
Token: SeSystemtimePrivilege	3692	powershell.exe
Token: SeProfSingleProcessPrivilege	3692	powershell.exe
Token: SeIncBasePriorityPrivilege	3692	powershell.exe
Token: SeCreatePagefilePrivilege	3692	powershell.exe
Token: SeBackupPrivilege	3692	powershell.exe
Token: SeRestorePrivilege	3692	powershell.exe
Token: SeShutdownPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeSystemEnvironmentPrivilege	3692	powershell.exe
Token: SeRemoteShutdownPrivilege	3692	powershell.exe
Token: SeUndockPrivilege	3692	powershell.exe
Token: SeManageVolumePrivilege	3692	powershell.exe
Token: 33	3692	powershell.exe
Token: 34	3692	powershell.exe
Token: 35	3692	powershell.exe
Token: 36	3692	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	352	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeIncreaseQuotaPrivilege	4100	powershell.exe
Token: SeSecurityPrivilege	4100	powershell.exe
Token: SeTakeOwnershipPrivilege	4100	powershell.exe
Token: SeLoadDriverPrivilege	4100	powershell.exe
Token: SeSystemProfilePrivilege	4100	powershell.exe
Token: SeSystemtimePrivilege	4100	powershell.exe
Token: SeProfSingleProcessPrivilege	4100	powershell.exe
Token: SeIncBasePriorityPrivilege	4100	powershell.exe
Token: SeCreatePagefilePrivilege	4100	powershell.exe
Token: SeBackupPrivilege	4100	powershell.exe
Token: SeRestorePrivilege	4100	powershell.exe
Token: SeShutdownPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeSystemEnvironmentPrivilege	4100	powershell.exe
Token: SeRemoteShutdownPrivilege	4100	powershell.exe
Token: SeUndockPrivilege	4100	powershell.exe
Token: SeManageVolumePrivilege	4100	powershell.exe
Token: 33	4100	powershell.exe
Token: 34	4100	powershell.exe
Token: 35	4100	powershell.exe
Token: 36	4100	powershell.exe
Token: SeIncreaseQuotaPrivilege	4200	powershell.exe
Token: SeSecurityPrivilege	4200	powershell.exe
Token: SeTakeOwnershipPrivilege	4200	powershell.exe
Token: SeLoadDriverPrivilege	4200	powershell.exe
Token: SeSystemProfilePrivilege	4200	powershell.exe
Token: SeSystemtimePrivilege	4200	powershell.exe
Token: SeProfSingleProcessPrivilege	4200	powershell.exe
Token: SeIncBasePriorityPrivilege	4200	powershell.exe
Token: SeCreatePagefilePrivilege	4200	powershell.exe
Token: SeBackupPrivilege	4200	powershell.exe
Token: SeRestorePrivilege	4200	powershell.exe
Token: SeShutdownPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeSystemEnvironmentPrivilege	4200	powershell.exe
Token: SeRemoteShutdownPrivilege	4200	powershell.exe
Token: SeUndockPrivilege	4200	powershell.exe
Token: SeManageVolumePrivilege	4200	powershell.exe
Token: 33	4200	powershell.exe
Token: 34	4200	powershell.exe
Token: 35	4200	powershell.exe
Token: 36	4200	powershell.exe
Token: SeIncreaseQuotaPrivilege	2776	powershell.exe
Token: SeSecurityPrivilege	2776	powershell.exe
Token: SeTakeOwnershipPrivilege	2776	powershell.exe
Token: SeLoadDriverPrivilege	2776	powershell.exe
Token: SeSystemProfilePrivilege	2776	powershell.exe
Token: SeSystemtimePrivilege	2776	powershell.exe
Token: SeProfSingleProcessPrivilege	2776	powershell.exe
Token: SeIncBasePriorityPrivilege	2776	powershell.exe
Token: SeCreatePagefilePrivilege	2776	powershell.exe
Token: SeBackupPrivilege	2776	powershell.exe
Token: SeRestorePrivilege	2776	powershell.exe
Token: SeShutdownPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeSystemEnvironmentPrivilege	2776	powershell.exe
Token: SeRemoteShutdownPrivilege	2776	powershell.exe
Token: SeUndockPrivilege	2776	powershell.exe
Token: SeManageVolumePrivilege	2776	powershell.exe
Token: 33	2776	powershell.exe
Token: 34	2776	powershell.exe
Token: 35	2776	powershell.exe
Token: 36	2776	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	powershell.exe
Token: SeSecurityPrivilege	1632	powershell.exe
Token: SeTakeOwnershipPrivilege	1632	powershell.exe
Token: SeLoadDriverPrivilege	1632	powershell.exe
Token: SeSystemProfilePrivilege	1632	powershell.exe
Token: SeSystemtimePrivilege	1632	powershell.exe
Token: SeProfSingleProcessPrivilege	1632	powershell.exe
Token: SeIncBasePriorityPrivilege	1632	powershell.exe
Token: SeCreatePagefilePrivilege	1632	powershell.exe
Token: SeBackupPrivilege	1632	powershell.exe
Token: SeRestorePrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeSystemEnvironmentPrivilege	1632	powershell.exe
Token: SeRemoteShutdownPrivilege	1632	powershell.exe
Token: SeUndockPrivilege	1632	powershell.exe
Token: SeManageVolumePrivilege	1632	powershell.exe
Token: 33	1632	powershell.exe
Token: 34	1632	powershell.exe
Token: 35	1632	powershell.exe
Token: 36	1632	powershell.exe
Token: SeIncreaseQuotaPrivilege	1996	powershell.exe
Token: SeSecurityPrivilege	1996	powershell.exe
Token: SeTakeOwnershipPrivilege	1996	powershell.exe
Token: SeLoadDriverPrivilege	1996	powershell.exe
Token: SeSystemProfilePrivilege	1996	powershell.exe
Token: SeSystemtimePrivilege	1996	powershell.exe
Token: SeProfSingleProcessPrivilege	1996	powershell.exe
Token: SeIncBasePriorityPrivilege	1996	powershell.exe
Token: SeCreatePagefilePrivilege	1996	powershell.exe
Token: SeBackupPrivilege	1996	powershell.exe
Token: SeRestorePrivilege	1996	powershell.exe
Token: SeShutdownPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeSystemEnvironmentPrivilege	1996	powershell.exe
Token: SeRemoteShutdownPrivilege	1996	powershell.exe
Token: SeUndockPrivilege	1996	powershell.exe
Token: SeManageVolumePrivilege	1996	powershell.exe
Token: 33	1996	powershell.exe
Token: 34	1996	powershell.exe
Token: 35	1996	powershell.exe
Token: 36	1996	powershell.exe
Token: SeIncreaseQuotaPrivilege	4432	powershell.exe
Token: SeSecurityPrivilege	4432	powershell.exe
Token: SeTakeOwnershipPrivilege	4432	powershell.exe
Token: SeLoadDriverPrivilege	4432	powershell.exe
Token: SeSystemProfilePrivilege	4432	powershell.exe
Token: SeSystemtimePrivilege	4432	powershell.exe
Token: SeProfSingleProcessPrivilege	4432	powershell.exe
Token: SeIncBasePriorityPrivilege	4432	powershell.exe
Token: SeCreatePagefilePrivilege	4432	powershell.exe
Token: SeBackupPrivilege	4432	powershell.exe
Token: SeRestorePrivilege	4432	powershell.exe
Token: SeShutdownPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeSystemEnvironmentPrivilege	4432	powershell.exe
Token: SeRemoteShutdownPrivilege	4432	powershell.exe
Token: SeUndockPrivilege	4432	powershell.exe
Token: SeManageVolumePrivilege	4432	powershell.exe
Token: 33	4432	powershell.exe
Token: 34	4432	powershell.exe
Token: 35	4432	powershell.exe
Token: 36	4432	powershell.exe
Token: SeIncreaseQuotaPrivilege	2152	powershell.exe
Token: SeSecurityPrivilege	2152	powershell.exe
Token: SeTakeOwnershipPrivilege	2152	powershell.exe
Token: SeLoadDriverPrivilege	2152	powershell.exe
Token: SeSystemProfilePrivilege	2152	powershell.exe
Token: SeSystemtimePrivilege	2152	powershell.exe
Token: SeProfSingleProcessPrivilege	2152	powershell.exe
Token: SeIncBasePriorityPrivilege	2152	powershell.exe
Token: SeCreatePagefilePrivilege	2152	powershell.exe
Token: SeBackupPrivilege	2152	powershell.exe
Token: SeRestorePrivilege	2152	powershell.exe
Token: SeShutdownPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeSystemEnvironmentPrivilege	2152	powershell.exe
Token: SeRemoteShutdownPrivilege	2152	powershell.exe
Token: SeUndockPrivilege	2152	powershell.exe
Token: SeManageVolumePrivilege	2152	powershell.exe
Token: 33	2152	powershell.exe
Token: 34	2152	powershell.exe
Token: 35	2152	powershell.exe
Token: 36	2152	powershell.exe
Token: SeIncreaseQuotaPrivilege	352	powershell.exe
Token: SeSecurityPrivilege	352	powershell.exe
Token: SeTakeOwnershipPrivilege	352	powershell.exe
Token: SeLoadDriverPrivilege	352	powershell.exe
Token: SeSystemProfilePrivilege	352	powershell.exe
Token: SeSystemtimePrivilege	352	powershell.exe
Token: SeProfSingleProcessPrivilege	352	powershell.exe
Token: SeIncBasePriorityPrivilege	352	powershell.exe
Token: SeCreatePagefilePrivilege	352	powershell.exe
Token: SeBackupPrivilege	352	powershell.exe
Token: SeRestorePrivilege	352	powershell.exe
Token: SeShutdownPrivilege	352	powershell.exe
Token: SeDebugPrivilege	352	powershell.exe
Token: SeSystemEnvironmentPrivilege	352	powershell.exe
Token: SeRemoteShutdownPrivilege	352	powershell.exe
Token: SeUndockPrivilege	352	powershell.exe
Token: SeManageVolumePrivilege	352	powershell.exe
Token: 33	352	powershell.exe
Token: 34	352	powershell.exe
Token: 35	352	powershell.exe
Token: 36	352	powershell.exe
Token: SeIncreaseQuotaPrivilege	1992	powershell.exe
Token: SeSecurityPrivilege	1992	powershell.exe
Token: SeTakeOwnershipPrivilege	1992	powershell.exe
Token: SeLoadDriverPrivilege	1992	powershell.exe
Token: SeSystemProfilePrivilege	1992	powershell.exe
Token: SeSystemtimePrivilege	1992	powershell.exe
Token: SeProfSingleProcessPrivilege	1992	powershell.exe
Token: SeIncBasePriorityPrivilege	1992	powershell.exe
Token: SeCreatePagefilePrivilege	1992	powershell.exe
Token: SeBackupPrivilege	1992	powershell.exe
Token: SeRestorePrivilege	1992	powershell.exe
Token: SeShutdownPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeSystemEnvironmentPrivilege	1992	powershell.exe
Token: SeRemoteShutdownPrivilege	1992	powershell.exe
Token: SeUndockPrivilege	1992	powershell.exe
Token: SeManageVolumePrivilege	1992	powershell.exe
Token: 33	1992	powershell.exe
Token: 34	1992	powershell.exe
Token: 35	1992	powershell.exe
Token: 36	1992	powershell.exe
Token: SeIncreaseQuotaPrivilege	4312	powershell.exe
Token: SeSecurityPrivilege	4312	powershell.exe
Token: SeTakeOwnershipPrivilege	4312	powershell.exe
Token: SeLoadDriverPrivilege	4312	powershell.exe
Token: SeSystemProfilePrivilege	4312	powershell.exe
Token: SeSystemtimePrivilege	4312	powershell.exe
Token: SeProfSingleProcessPrivilege	4312	powershell.exe
Token: SeIncBasePriorityPrivilege	4312	powershell.exe
Token: SeCreatePagefilePrivilege	4312	powershell.exe
Token: SeBackupPrivilege	4312	powershell.exe
Token: SeRestorePrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeSystemEnvironmentPrivilege	4312	powershell.exe
Token: SeRemoteShutdownPrivilege	4312	powershell.exe
Token: SeUndockPrivilege	4312	powershell.exe
Token: SeManageVolumePrivilege	4312	powershell.exe
Token: 33	4312	powershell.exe
Token: 34	4312	powershell.exe
Token: 35	4312	powershell.exe
Token: 36	4312	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4652	powershell.exe
Token: SeSecurityPrivilege	4652	powershell.exe
Token: SeTakeOwnershipPrivilege	4652	powershell.exe
Token: SeLoadDriverPrivilege	4652	powershell.exe
Token: SeSystemProfilePrivilege	4652	powershell.exe
Token: SeSystemtimePrivilege	4652	powershell.exe
Token: SeProfSingleProcessPrivilege	4652	powershell.exe
Token: SeIncBasePriorityPrivilege	4652	powershell.exe
Token: SeCreatePagefilePrivilege	4652	powershell.exe
Token: SeBackupPrivilege	4652	powershell.exe
Token: SeRestorePrivilege	4652	powershell.exe
Token: SeShutdownPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeSystemEnvironmentPrivilege	4652	powershell.exe
Token: SeRemoteShutdownPrivilege	4652	powershell.exe
Token: SeUndockPrivilege	4652	powershell.exe
Token: SeManageVolumePrivilege	4652	powershell.exe
Token: 33	4652	powershell.exe
Token: 34	4652	powershell.exe
Token: 35	4652	powershell.exe
Token: 36	4652	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1520	ce56f130c12f75c8b26151d1c3a6de37.exe
1520	ce56f130c12f75c8b26151d1c3a6de37.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 2460 wrote to memory of 1520	2460	ce56f130c12f75c8b26151d1c3a6de37.exe	76
PID 1520 wrote to memory of 1848	1520	ce56f130c12f75c8b26151d1c3a6de37.exe	77
PID 1520 wrote to memory of 1848	1520	ce56f130c12f75c8b26151d1c3a6de37.exe	77
PID 1520 wrote to memory of 1848	1520	ce56f130c12f75c8b26151d1c3a6de37.exe	77
PID 2176 wrote to memory of 2720	2176	DllHost.exe	79
PID 2176 wrote to memory of 2720	2176	DllHost.exe	79
PID 2176 wrote to memory of 2720	2176	DllHost.exe	79
PID 2720 wrote to memory of 3224	2720	cmd.exe	81
PID 2720 wrote to memory of 3224	2720	cmd.exe	81
PID 2176 wrote to memory of 3756	2176	DllHost.exe	82
PID 2176 wrote to memory of 3756	2176	DllHost.exe	82
PID 2176 wrote to memory of 3756	2176	DllHost.exe	82
PID 3224 wrote to memory of 3692	3224	3hnrkr1a.exe	84
PID 3224 wrote to memory of 3692	3224	3hnrkr1a.exe	84
PID 3224 wrote to memory of 2776	3224	3hnrkr1a.exe	88
PID 3224 wrote to memory of 2776	3224	3hnrkr1a.exe	88
PID 3224 wrote to memory of 1632	3224	3hnrkr1a.exe	90
PID 3224 wrote to memory of 1632	3224	3hnrkr1a.exe	90
PID 3224 wrote to memory of 1996	3224	3hnrkr1a.exe	92
PID 3224 wrote to memory of 1996	3224	3hnrkr1a.exe	92
PID 3224 wrote to memory of 2152	3224	3hnrkr1a.exe	94
PID 3224 wrote to memory of 2152	3224	3hnrkr1a.exe	94
PID 3224 wrote to memory of 352	3224	3hnrkr1a.exe	96
PID 3224 wrote to memory of 352	3224	3hnrkr1a.exe	96
PID 3224 wrote to memory of 1992	3224	3hnrkr1a.exe	98
PID 3224 wrote to memory of 1992	3224	3hnrkr1a.exe	98
PID 3224 wrote to memory of 4100	3224	3hnrkr1a.exe	100
PID 3224 wrote to memory of 4100	3224	3hnrkr1a.exe	100
PID 3224 wrote to memory of 4200	3224	3hnrkr1a.exe	102
PID 3224 wrote to memory of 4200	3224	3hnrkr1a.exe	102
PID 3224 wrote to memory of 4312	3224	3hnrkr1a.exe	104
PID 3224 wrote to memory of 4312	3224	3hnrkr1a.exe	104
PID 3224 wrote to memory of 4432	3224	3hnrkr1a.exe	106
PID 3224 wrote to memory of 4432	3224	3hnrkr1a.exe	106
PID 3224 wrote to memory of 4536	3224	3hnrkr1a.exe	108
PID 3224 wrote to memory of 4536	3224	3hnrkr1a.exe	108
PID 3224 wrote to memory of 4652	3224	3hnrkr1a.exe	110
PID 3224 wrote to memory of 4652	3224	3hnrkr1a.exe	110

C:\Users\Admin\AppData\Local\Temp\ce56f130c12f75c8b26151d1c3a6de37.exe
"C:\Users\Admin\AppData\Local\Temp\ce56f130c12f75c8b26151d1c3a6de37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\ce56f130c12f75c8b26151d1c3a6de37.exe
  "C:\Users\Admin\AppData\Local\Temp\ce56f130c12f75c8b26151d1c3a6de37.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1520
- - \??\c:\windows\SysWOW64\cmstp.exe
    "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ak10gnvw.inf
    3⤵
    PID:1848

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\3hnrkr1a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\temp\3hnrkr1a.exe
    C:\Windows\temp\3hnrkr1a.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-48-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/1520-13-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/1520-22-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/1520-12-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/1520-9-0x0000000073880000-0x0000000073F6E000-memory.dmp

Download

memory/1520-6-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1632-42-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/1848-20-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/1848-18-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/1992-50-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/1996-45-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/2152-46-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/2460-5-0x0000000002C50000-0x0000000002C5D000-memory.dmp

Download

memory/2460-4-0x0000000002B80000-0x0000000002B96000-memory.dmp

Download

memory/2460-0-0x0000000073870000-0x0000000073F5E000-memory.dmp

Download

memory/2460-3-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/2460-1-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/2776-41-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/3224-30-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/3224-28-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/3692-33-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/3692-34-0x000002336EE50000-0x000002336EE51000-memory.dmp

Download

memory/3692-35-0x000002336F3D0000-0x000002336F3D1000-memory.dmp

Download

memory/4100-53-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/4200-57-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/4312-60-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/4432-63-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/4536-68-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download

memory/4652-69-0x00007FFBC6640000-0x00007FFBC702C000-memory.dmp

Download