Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17/05/2021, 11:38
Static task
static1
Behavioral task
behavioral1
Sample
49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
Resource
win10v20210410
General
-
Target
49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe
-
Size
137KB
-
MD5
9aa3cc9d7c641ea22cfa3e5233e13c94
-
SHA1
1970f6c17567d56c3e7840fe33a6959dd887fca2
-
SHA256
49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71
-
SHA512
ef87881534199c3eac630883701b86ac21e6143a61b2224c39421b23bf5d9a59b8b1b868becf8632582451d709be46c944359bbd132b75ec9591a5382b098e0c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Deletes itself 1 IoCs
pid Process 996 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe = "C:\\Windows\\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe" 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\desktop.ini 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened (read-only) \??\F: 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.ICO 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00389_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341475.JPG 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00204_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115864.GIF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187863.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03331_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ro.pak 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jre7\bin\jsdt.dll 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187835.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10302_.GIF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OOFTMPL.CFG 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SUBMIT.JS 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1972 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 872 PING.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe Token: SeTcbPrivilege 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe Token: SeDebugPrivilege 1972 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1572 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 29 PID 2000 wrote to memory of 1572 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 29 PID 2000 wrote to memory of 1572 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 29 PID 2000 wrote to memory of 1572 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 29 PID 2000 wrote to memory of 996 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 30 PID 2000 wrote to memory of 996 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 30 PID 2000 wrote to memory of 996 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 30 PID 2000 wrote to memory of 996 2000 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 30 PID 996 wrote to memory of 872 996 cmd.exe 32 PID 996 wrote to memory of 872 996 cmd.exe 32 PID 996 wrote to memory of 872 996 cmd.exe 32 PID 1572 wrote to memory of 684 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 35 PID 1572 wrote to memory of 684 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 35 PID 1572 wrote to memory of 684 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 35 PID 1572 wrote to memory of 684 1572 49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe 35 PID 684 wrote to memory of 1972 684 cmd.exe 37 PID 684 wrote to memory of 1972 684 cmd.exe 37 PID 684 wrote to memory of 1972 684 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe"C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe"C:\Windows\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe" g g g o n e1232⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\System32\cmd.exe/C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe3⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
-
-
C:\Windows\System32\cmd.exe/c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\49fd52a3f3d1d46dc065217e588d1d29fba4d978cd8fdb2887fd603320540f71.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\PING.EXEping localhost -n 33⤵
- Runs ping.exe
PID:872
-
-