Analysis
-
max time kernel
153s -
max time network
34s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
21-10-2020 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Recu.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
Recu.exe
Resource
win10
General
-
Target
Recu.exe
-
Size
871KB
-
MD5
fe655433e25918abfbf8d0a748b53ebd
-
SHA1
2481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
-
SHA256
c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
-
SHA512
7ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:100
DC_MUTEX-J4K9R5R
-
gencode
XsFtyCs9yfyB
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Applicatio.exepid process 1936 Applicatio.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1908 cmd.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\ApplicatSTUC = "C:\\Users\\Admin\\AppData\\Roaming\\Applicatio.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Applicatio.exedescription pid process target process PID 1936 set thread context of 2040 1936 Applicatio.exe mscorsvw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Applicatio.exepid process 1936 Applicatio.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Recu.exeApplicatio.exemscorsvw.exedescription pid process Token: SeDebugPrivilege 1412 Recu.exe Token: SeDebugPrivilege 1936 Applicatio.exe Token: SeIncreaseQuotaPrivilege 2040 mscorsvw.exe Token: SeSecurityPrivilege 2040 mscorsvw.exe Token: SeTakeOwnershipPrivilege 2040 mscorsvw.exe Token: SeLoadDriverPrivilege 2040 mscorsvw.exe Token: SeSystemProfilePrivilege 2040 mscorsvw.exe Token: SeSystemtimePrivilege 2040 mscorsvw.exe Token: SeProfSingleProcessPrivilege 2040 mscorsvw.exe Token: SeIncBasePriorityPrivilege 2040 mscorsvw.exe Token: SeCreatePagefilePrivilege 2040 mscorsvw.exe Token: SeBackupPrivilege 2040 mscorsvw.exe Token: SeRestorePrivilege 2040 mscorsvw.exe Token: SeShutdownPrivilege 2040 mscorsvw.exe Token: SeDebugPrivilege 2040 mscorsvw.exe Token: SeSystemEnvironmentPrivilege 2040 mscorsvw.exe Token: SeChangeNotifyPrivilege 2040 mscorsvw.exe Token: SeRemoteShutdownPrivilege 2040 mscorsvw.exe Token: SeUndockPrivilege 2040 mscorsvw.exe Token: SeManageVolumePrivilege 2040 mscorsvw.exe Token: SeImpersonatePrivilege 2040 mscorsvw.exe Token: SeCreateGlobalPrivilege 2040 mscorsvw.exe Token: 33 2040 mscorsvw.exe Token: 34 2040 mscorsvw.exe Token: 35 2040 mscorsvw.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mscorsvw.exepid process 2040 mscorsvw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Recu.execmd.exeApplicatio.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1412 wrote to memory of 1584 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1584 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1584 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1584 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1908 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1908 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1908 1412 Recu.exe cmd.exe PID 1412 wrote to memory of 1908 1412 Recu.exe cmd.exe PID 1908 wrote to memory of 1936 1908 cmd.exe Applicatio.exe PID 1908 wrote to memory of 1936 1908 cmd.exe Applicatio.exe PID 1908 wrote to memory of 1936 1908 cmd.exe Applicatio.exe PID 1908 wrote to memory of 1936 1908 cmd.exe Applicatio.exe PID 1936 wrote to memory of 1008 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1008 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1008 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1008 1936 Applicatio.exe cmd.exe PID 1008 wrote to memory of 300 1008 cmd.exe reg.exe PID 1008 wrote to memory of 300 1008 cmd.exe reg.exe PID 1008 wrote to memory of 300 1008 cmd.exe reg.exe PID 1008 wrote to memory of 300 1008 cmd.exe reg.exe PID 1936 wrote to memory of 940 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 940 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 940 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 940 1936 Applicatio.exe cmd.exe PID 940 wrote to memory of 692 940 cmd.exe reg.exe PID 940 wrote to memory of 692 940 cmd.exe reg.exe PID 940 wrote to memory of 692 940 cmd.exe reg.exe PID 940 wrote to memory of 692 940 cmd.exe reg.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 1732 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1732 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1732 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1732 1936 Applicatio.exe cmd.exe PID 1732 wrote to memory of 1172 1732 cmd.exe reg.exe PID 1732 wrote to memory of 1172 1732 cmd.exe reg.exe PID 1732 wrote to memory of 1172 1732 cmd.exe reg.exe PID 1732 wrote to memory of 1172 1732 cmd.exe reg.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 2040 1936 Applicatio.exe mscorsvw.exe PID 1936 wrote to memory of 1220 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1220 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1220 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 1220 1936 Applicatio.exe cmd.exe PID 1220 wrote to memory of 984 1220 cmd.exe reg.exe PID 1220 wrote to memory of 984 1220 cmd.exe reg.exe PID 1220 wrote to memory of 984 1220 cmd.exe reg.exe PID 1220 wrote to memory of 984 1220 cmd.exe reg.exe PID 1936 wrote to memory of 944 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 944 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 944 1936 Applicatio.exe cmd.exe PID 1936 wrote to memory of 944 1936 Applicatio.exe cmd.exe PID 944 wrote to memory of 1672 944 cmd.exe reg.exe PID 944 wrote to memory of 1672 944 cmd.exe reg.exe PID 944 wrote to memory of 1672 944 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Recu.exe"C:\Users\Admin\AppData\Local\Temp\Recu.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Recu.exe" "C:\Users\Admin\AppData\Roaming\Applicatio.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\Applicatio.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Applicatio.exe"C:\Users\Admin\AppData\Roaming\Applicatio.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "ApplicatSTUC" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Applicatio.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Applicatio.exeMD5
fe655433e25918abfbf8d0a748b53ebd
SHA12481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
SHA256c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
SHA5127ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
-
C:\Users\Admin\AppData\Roaming\Applicatio.exeMD5
fe655433e25918abfbf8d0a748b53ebd
SHA12481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
SHA256c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
SHA5127ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
-
\Users\Admin\AppData\Roaming\Applicatio.exeMD5
fe655433e25918abfbf8d0a748b53ebd
SHA12481b3aa2a0084a7aa8a5dae26e7a95bd948cd61
SHA256c960f47eb155a0066c0e4e279c296d0516edf66cf032b44188fe3d7f3a16aef6
SHA5127ff96e75adaf8c03f99825bbc93bfe2391934fa71acb2a80cd02a994105497ca76f96f62ea8905409d97c2855ee7fc9a12dd3f4f35f0c8456108925d28023a2d
-
memory/112-120-0x0000000000000000-mapping.dmp
-
memory/112-129-0x0000000000000000-mapping.dmp
-
memory/292-52-0x0000000000000000-mapping.dmp
-
memory/300-22-0x0000000000000000-mapping.dmp
-
memory/380-65-0x0000000000000000-mapping.dmp
-
memory/516-109-0x0000000000000000-mapping.dmp
-
memory/516-96-0x0000000000000000-mapping.dmp
-
memory/548-73-0x0000000000000000-mapping.dmp
-
memory/692-89-0x0000000000000000-mapping.dmp
-
memory/692-25-0x0000000000000000-mapping.dmp
-
memory/748-37-0x0000000000000000-mapping.dmp
-
memory/812-102-0x0000000000000000-mapping.dmp
-
memory/812-114-0x0000000000000000-mapping.dmp
-
memory/832-49-0x0000000000000000-mapping.dmp
-
memory/836-126-0x0000000000000000-mapping.dmp
-
memory/836-104-0x0000000000000000-mapping.dmp
-
memory/896-34-0x0000000000000000-mapping.dmp
-
memory/912-90-0x0000000000000000-mapping.dmp
-
memory/932-57-0x0000000000000000-mapping.dmp
-
memory/936-58-0x0000000000000000-mapping.dmp
-
memory/936-128-0x0000000000000000-mapping.dmp
-
memory/940-24-0x0000000000000000-mapping.dmp
-
memory/944-30-0x0000000000000000-mapping.dmp
-
memory/980-88-0x0000000000000000-mapping.dmp
-
memory/980-124-0x0000000000000000-mapping.dmp
-
memory/980-48-0x0000000000000000-mapping.dmp
-
memory/984-29-0x0000000000000000-mapping.dmp
-
memory/1008-21-0x0000000000000000-mapping.dmp
-
memory/1028-81-0x0000000000000000-mapping.dmp
-
memory/1028-62-0x0000000000000000-mapping.dmp
-
memory/1040-111-0x0000000000000000-mapping.dmp
-
memory/1044-82-0x0000000000000000-mapping.dmp
-
memory/1044-42-0x0000000000000000-mapping.dmp
-
memory/1088-71-0x0000000000000000-mapping.dmp
-
memory/1128-121-0x0000000000000000-mapping.dmp
-
memory/1128-35-0x0000000000000000-mapping.dmp
-
memory/1132-80-0x0000000000000000-mapping.dmp
-
memory/1132-119-0x0000000000000000-mapping.dmp
-
memory/1152-56-0x0000000000000000-mapping.dmp
-
memory/1160-75-0x0000000000000000-mapping.dmp
-
memory/1172-27-0x0000000000000000-mapping.dmp
-
memory/1172-54-0x0000000000000000-mapping.dmp
-
memory/1172-125-0x0000000000000000-mapping.dmp
-
memory/1200-41-0x0000000000000000-mapping.dmp
-
memory/1204-95-0x0000000000000000-mapping.dmp
-
memory/1204-60-0x0000000000000000-mapping.dmp
-
memory/1220-28-0x0000000000000000-mapping.dmp
-
memory/1292-39-0x0000000000000000-mapping.dmp
-
memory/1408-107-0x0000000000000000-mapping.dmp
-
memory/1412-1-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/1412-3-0x00000000005D0000-0x00000000005E7000-memory.dmpFilesize
92KB
-
memory/1412-4-0x0000000000600000-0x000000000061F000-memory.dmpFilesize
124KB
-
memory/1412-0-0x0000000074CB0000-0x000000007539E000-memory.dmpFilesize
6.9MB
-
memory/1412-112-0x0000000000000000-mapping.dmp
-
memory/1412-46-0x0000000000000000-mapping.dmp
-
memory/1416-100-0x0000000000000000-mapping.dmp
-
memory/1424-51-0x0000000000000000-mapping.dmp
-
memory/1432-83-0x0000000000000000-mapping.dmp
-
memory/1440-91-0x0000000000000000-mapping.dmp
-
memory/1464-127-0x0000000000000000-mapping.dmp
-
memory/1476-117-0x0000000000000000-mapping.dmp
-
memory/1476-92-0x0000000000000000-mapping.dmp
-
memory/1484-106-0x0000000000000000-mapping.dmp
-
memory/1512-99-0x0000000000000000-mapping.dmp
-
memory/1520-113-0x0000000000000000-mapping.dmp
-
memory/1520-44-0x0000000000000000-mapping.dmp
-
memory/1520-84-0x0000000000000000-mapping.dmp
-
memory/1520-66-0x0000000000000000-mapping.dmp
-
memory/1524-78-0x0000000000000000-mapping.dmp
-
memory/1532-97-0x0000000000000000-mapping.dmp
-
memory/1532-64-0x0000000000000000-mapping.dmp
-
memory/1544-93-0x0000000000000000-mapping.dmp
-
memory/1548-98-0x0000000000000000-mapping.dmp
-
memory/1556-76-0x0000000000000000-mapping.dmp
-
memory/1556-118-0x0000000000000000-mapping.dmp
-
memory/1564-108-0x0000000000000000-mapping.dmp
-
memory/1572-40-0x0000000000000000-mapping.dmp
-
memory/1572-63-0x0000000000000000-mapping.dmp
-
memory/1576-85-0x0000000000000000-mapping.dmp
-
memory/1584-6-0x0000000000000000-mapping.dmp
-
memory/1596-74-0x0000000000000000-mapping.dmp
-
memory/1608-123-0x0000000000000000-mapping.dmp
-
memory/1628-61-0x0000000000000000-mapping.dmp
-
memory/1636-115-0x0000000000000000-mapping.dmp
-
memory/1656-94-0x0000000000000000-mapping.dmp
-
memory/1664-55-0x0000000000000000-mapping.dmp
-
memory/1672-31-0x0000000000000000-mapping.dmp
-
memory/1676-59-0x0000000000000000-mapping.dmp
-
memory/1684-77-0x0000000000000000-mapping.dmp
-
memory/1732-26-0x0000000000000000-mapping.dmp
-
memory/1748-87-0x0000000000000000-mapping.dmp
-
memory/1772-45-0x0000000000000000-mapping.dmp
-
memory/1780-79-0x0000000000000000-mapping.dmp
-
memory/1788-68-0x0000000000000000-mapping.dmp
-
memory/1792-86-0x0000000000000000-mapping.dmp
-
memory/1796-36-0x0000000000000000-mapping.dmp
-
memory/1800-69-0x0000000000000000-mapping.dmp
-
memory/1832-53-0x0000000000000000-mapping.dmp
-
memory/1876-103-0x0000000000000000-mapping.dmp
-
memory/1880-72-0x0000000000000000-mapping.dmp
-
memory/1904-67-0x0000000000000000-mapping.dmp
-
memory/1908-7-0x0000000000000000-mapping.dmp
-
memory/1936-23-0x0000000001FE0000-0x0000000001FEA000-memory.dmpFilesize
40KB
-
memory/1936-10-0x0000000000000000-mapping.dmp
-
memory/1936-12-0x0000000074CB0000-0x000000007539E000-memory.dmpFilesize
6.9MB
-
memory/1936-16-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/1960-101-0x0000000000000000-mapping.dmp
-
memory/1964-47-0x0000000000000000-mapping.dmp
-
memory/1984-122-0x0000000000000000-mapping.dmp
-
memory/2000-110-0x0000000000000000-mapping.dmp
-
memory/2004-116-0x0000000000000000-mapping.dmp
-
memory/2004-70-0x0000000000000000-mapping.dmp
-
memory/2012-43-0x0000000000000000-mapping.dmp
-
memory/2016-105-0x0000000000000000-mapping.dmp
-
memory/2024-50-0x0000000000000000-mapping.dmp
-
memory/2040-32-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2040-33-0x000000000048F888-mapping.dmp
-
memory/2040-38-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB