Analysis
- max time kernel
151s - max time network
58s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
1adf10dff75f331c15f6a273db0e62c4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1adf10dff75f331c15f6a273db0e62c4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1adf10dff75f331c15f6a273db0e62c4.exe
- Size 667KB
- Sample201109-pqbk2ebhex
- SHA256 ec3fae8f7d132adb356d2edf3d8997e7b22165949a698f74bc79586f5e9e9bd6
- MD5 1adf10dff75f331c15f6a273db0e62c4
- SHA1 ecda5aa8aa72077a2adc9d5b355540e2590f5dda
- SHA512 55a11ba0e21ed9317e914d672098eef3aa3068957ed7c97a13bbfd6dbc439168ea30f59c2ebd6b8ad1c66e0c7e8b47498df6bcaabbe0b8c0b416c7770fb0508a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
premium49.web-hosting.com
-
Port
587
-
Username
-
Password
NR*[Q66kH&&@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 12 IoCs
resource yara_rule behavioral1/memory/876-4-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/876-5-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/876-6-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/876-7-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/752-17-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/292-29-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/948-41-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/692-55-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/1040-67-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/1588-79-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/1160-95-0x000000000044CCFE-mapping.dmp family_agenttesla behavioral1/memory/1188-107-0x000000000044CCFE-mapping.dmp family_agenttesla - Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghvd = "C:\\Users\\Admin\\AppData\\Roaming\\xxxx.exe" 1adf10dff75f331c15f6a273db0e62c4.exe - Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 1916 set thread context of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1704 set thread context of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1692 set thread context of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 472 set thread context of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 1728 set thread context of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1104 set thread context of 1040 1104 1adf10dff75f331c15f6a273db0e62c4.exe 41 PID 1560 set thread context of 1588 1560 1adf10dff75f331c15f6a273db0e62c4.exe 43 PID 1368 set thread context of 1160 1368 1adf10dff75f331c15f6a273db0e62c4.exe 46 PID 1912 set thread context of 1188 1912 1adf10dff75f331c15f6a273db0e62c4.exe 48 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1916 1adf10dff75f331c15f6a273db0e62c4.exe - Suspicious behavior: MapViewOfSection 11 IoCs
pid Process 1916 1adf10dff75f331c15f6a273db0e62c4.exe 1704 1adf10dff75f331c15f6a273db0e62c4.exe 1692 1adf10dff75f331c15f6a273db0e62c4.exe 472 1adf10dff75f331c15f6a273db0e62c4.exe 1728 1adf10dff75f331c15f6a273db0e62c4.exe 1728 1adf10dff75f331c15f6a273db0e62c4.exe 1104 1adf10dff75f331c15f6a273db0e62c4.exe 1560 1adf10dff75f331c15f6a273db0e62c4.exe 1368 1adf10dff75f331c15f6a273db0e62c4.exe 1368 1adf10dff75f331c15f6a273db0e62c4.exe 1912 1adf10dff75f331c15f6a273db0e62c4.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1916 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 876 RegAsm.exe Token: SeDebugPrivilege 1704 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 752 RegAsm.exe Token: SeDebugPrivilege 1692 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 292 RegAsm.exe Token: SeDebugPrivilege 472 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 948 RegAsm.exe Token: SeDebugPrivilege 1728 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 692 RegAsm.exe Token: SeDebugPrivilege 1104 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 1040 RegAsm.exe Token: SeDebugPrivilege 1560 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 1588 RegAsm.exe Token: SeDebugPrivilege 1368 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 1160 RegAsm.exe Token: SeDebugPrivilege 1912 1adf10dff75f331c15f6a273db0e62c4.exe Token: SeDebugPrivilege 1188 RegAsm.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 876 1916 1adf10dff75f331c15f6a273db0e62c4.exe 29 PID 1916 wrote to memory of 1704 1916 1adf10dff75f331c15f6a273db0e62c4.exe 30 PID 1916 wrote to memory of 1704 1916 1adf10dff75f331c15f6a273db0e62c4.exe 30 PID 1916 wrote to memory of 1704 1916 1adf10dff75f331c15f6a273db0e62c4.exe 30 PID 1916 wrote to memory of 1704 1916 1adf10dff75f331c15f6a273db0e62c4.exe 30 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 752 1704 1adf10dff75f331c15f6a273db0e62c4.exe 32 PID 1704 wrote to memory of 1692 1704 1adf10dff75f331c15f6a273db0e62c4.exe 33 PID 1704 wrote to memory of 1692 1704 1adf10dff75f331c15f6a273db0e62c4.exe 33 PID 1704 wrote to memory of 1692 1704 1adf10dff75f331c15f6a273db0e62c4.exe 33 PID 1704 wrote to memory of 1692 1704 1adf10dff75f331c15f6a273db0e62c4.exe 33 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 292 1692 1adf10dff75f331c15f6a273db0e62c4.exe 34 PID 1692 wrote to memory of 472 1692 1adf10dff75f331c15f6a273db0e62c4.exe 35 PID 1692 wrote to memory of 472 1692 1adf10dff75f331c15f6a273db0e62c4.exe 35 PID 1692 wrote to memory of 472 1692 1adf10dff75f331c15f6a273db0e62c4.exe 35 PID 1692 wrote to memory of 472 1692 1adf10dff75f331c15f6a273db0e62c4.exe 35 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 948 472 1adf10dff75f331c15f6a273db0e62c4.exe 36 PID 472 wrote to memory of 1728 472 1adf10dff75f331c15f6a273db0e62c4.exe 37 PID 472 wrote to memory of 1728 472 1adf10dff75f331c15f6a273db0e62c4.exe 37 PID 472 wrote to memory of 1728 472 1adf10dff75f331c15f6a273db0e62c4.exe 37 PID 472 wrote to memory of 1728 472 1adf10dff75f331c15f6a273db0e62c4.exe 37 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 1700 1728 1adf10dff75f331c15f6a273db0e62c4.exe 38 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 692 1728 1adf10dff75f331c15f6a273db0e62c4.exe 39 PID 1728 wrote to memory of 1104 1728 1adf10dff75f331c15f6a273db0e62c4.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:292
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"4⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"5⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵PID:1700
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"6⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"7⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"8⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵PID:1832
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"9⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"C:\Users\Admin\AppData\Local\Temp\1adf10dff75f331c15f6a273db0e62c4.exe"10⤵PID:1520
-
-
-
-
-
-
-
-
-