Analysis
- max time kernel
162s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe
- Size 1.8MB
- Sample220124-c871baafdm
- SHA256 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97
- MD5 186b2e42de0d2e58d070313bd6730243
- SHA1 f79da0d8bb1267f9906fad1111bd929a41b18c03
- SHA512 1e9e2d897ba1e1b7b8ce86d354e0f7342141353391fc81b3962117bb02970fb69977890bc3426c435e6c358fee049b57af06bee398fd4d10b2864ac6cbcece09
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 2424 vdduglhies.exe 420 nlpivsqrby.exe 368 bindsvc.exe 1936 SearchUserHost.exe 3048 Explorer.EXE 3176 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe -
resource yara_rule behavioral2/files/0x000600000001ab36-121.dat upx behavioral2/files/0x000600000001ab36-122.dat upx - Loads dropped DLL 4 IoCs
pid Process 3604 SearchIndexer.exe 1936 SearchUserHost.exe 2024 SearchProtocolHost.exe 3956 SearchFilterHost.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\System32\Identities\bindsvc.exe nlpivsqrby.exe File created C:\Windows\system32\SearchUserHost.exe SearchIndexer.exe File opened for modification C:\Windows\system32\SearchUserHost.exe SearchIndexer.exe File created C:\Windows\System32\wimsvc.exe nlpivsqrby.exe File created C:\Windows\system32\msfte.dll nlpivsqrby.exe File created C:\Windows\system32\oci.dll nlpivsqrby.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SearchProtocolHost.exe File opened for modification C:\Windows\System32\Identities nlpivsqrby.exe File created C:\Windows\System32\Identities\wideshut.exe nlpivsqrby.exe File opened for modification C:\Windows\System32\Identities\wideshut.exe nlpivsqrby.exe File created C:\Windows\System32\Identities\sharp.exe nlpivsqrby.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT SearchIndexer.exe - Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 3 IoCs
pid pid_target Process procid_target 1160 3956 WerFault.exe 81 1436 1244 WerFault.exe 121 3856 3372 WerFault.exe 123 - NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000600000001ab32-120.dat nsis_installer_1 behavioral2/files/0x000600000001ab32-120.dat nsis_installer_2 behavioral2/files/0x000500000001ab38-129.dat nsis_installer_1 behavioral2/files/0x000500000001ab38-129.dat nsis_installer_2 behavioral2/files/0x000500000001ab38-133.dat nsis_installer_1 behavioral2/files/0x000500000001ab38-133.dat nsis_installer_2 - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3188 tasklist.exe 3360 tasklist.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1200 NETSTAT.EXE 2956 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 360 systeminfo.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice\Hash = "RDCZULOMhe0=" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.avi = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice\Hash = "fogBQRPfGEI=" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9e60475f8edd701 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\Hash = "rJeY8eFS9k8=" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.jpg = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bea0e275f8edd701 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\Hash = "aFRMH4/jOM0=" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a242d78f8edd701 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000f0df70f8edd701 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice\Hash = "ZJFxSLTxxHc=" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.bmp = "1" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\ProgId = "AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 2072 PING.EXE - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3604 SearchIndexer.exe 3604 SearchIndexer.exe 3604 SearchIndexer.exe 3604 SearchIndexer.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 3188 tasklist.exe 3188 tasklist.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe 1936 SearchUserHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: 33 3604 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3604 SearchIndexer.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeDebugPrivilege 3188 tasklist.exe Token: SeDebugPrivilege 1200 NETSTAT.EXE Token: SeDebugPrivilege 3360 tasklist.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe Token: SeDebugPrivilege 1936 SearchUserHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2424 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 69 PID 1804 wrote to memory of 2424 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 69 PID 1804 wrote to memory of 2424 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 69 PID 1804 wrote to memory of 420 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 70 PID 1804 wrote to memory of 420 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 70 PID 1804 wrote to memory of 420 1804 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe 70 PID 420 wrote to memory of 368 420 nlpivsqrby.exe 71 PID 420 wrote to memory of 368 420 nlpivsqrby.exe 71 PID 420 wrote to memory of 368 420 nlpivsqrby.exe 71 PID 3604 wrote to memory of 1936 3604 SearchIndexer.exe 73 PID 3604 wrote to memory of 1936 3604 SearchIndexer.exe 73 PID 1936 wrote to memory of 3048 1936 SearchUserHost.exe 21 PID 2424 wrote to memory of 3176 2424 vdduglhies.exe 74 PID 2424 wrote to memory of 3176 2424 vdduglhies.exe 74 PID 2424 wrote to memory of 3176 2424 vdduglhies.exe 74 PID 1936 wrote to memory of 1060 1936 SearchUserHost.exe 77 PID 1936 wrote to memory of 1060 1936 SearchUserHost.exe 77 PID 3048 wrote to memory of 1916 3048 Explorer.EXE 75 PID 3048 wrote to memory of 1916 3048 Explorer.EXE 75 PID 1060 wrote to memory of 360 1060 cmd.exe 78 PID 1060 wrote to memory of 360 1060 cmd.exe 78 PID 3604 wrote to memory of 2024 3604 SearchIndexer.exe 80 PID 3604 wrote to memory of 2024 3604 SearchIndexer.exe 80 PID 3604 wrote to memory of 3956 3604 SearchIndexer.exe 81 PID 3604 wrote to memory of 3956 3604 SearchIndexer.exe 81 PID 3048 wrote to memory of 2320 3048 Explorer.EXE 82 PID 3048 wrote to memory of 2320 3048 Explorer.EXE 82 PID 3048 wrote to memory of 2012 3048 Explorer.EXE 83 PID 3048 wrote to memory of 2012 3048 Explorer.EXE 83 PID 3048 wrote to memory of 4000 3048 Explorer.EXE 84 PID 3048 wrote to memory of 4000 3048 Explorer.EXE 84 PID 420 wrote to memory of 816 420 nlpivsqrby.exe 86 PID 420 wrote to memory of 816 420 nlpivsqrby.exe 86 PID 816 wrote to memory of 824 816 cmd.exe 88 PID 816 wrote to memory of 824 816 cmd.exe 88 PID 420 wrote to memory of 2220 420 nlpivsqrby.exe 89 PID 420 wrote to memory of 2220 420 nlpivsqrby.exe 89 PID 1936 wrote to memory of 2136 1936 SearchUserHost.exe 91 PID 1936 wrote to memory of 2136 1936 SearchUserHost.exe 91 PID 2136 wrote to memory of 3188 2136 cmd.exe 93 PID 2136 wrote to memory of 3188 2136 cmd.exe 93 PID 1936 wrote to memory of 2356 1936 SearchUserHost.exe 94 PID 1936 wrote to memory of 2356 1936 SearchUserHost.exe 94 PID 2356 wrote to memory of 1200 2356 cmd.exe 96 PID 2356 wrote to memory of 1200 2356 cmd.exe 96 PID 1936 wrote to memory of 3856 1936 SearchUserHost.exe 97 PID 1936 wrote to memory of 3856 1936 SearchUserHost.exe 97 PID 3856 wrote to memory of 2956 3856 cmd.exe 99 PID 3856 wrote to memory of 2956 3856 cmd.exe 99 PID 1936 wrote to memory of 3792 1936 SearchUserHost.exe 100 PID 1936 wrote to memory of 3792 1936 SearchUserHost.exe 100 PID 3792 wrote to memory of 1592 3792 cmd.exe 102 PID 3792 wrote to memory of 1592 3792 cmd.exe 102 PID 1936 wrote to memory of 3488 1936 SearchUserHost.exe 103 PID 1936 wrote to memory of 3488 1936 SearchUserHost.exe 103 PID 3488 wrote to memory of 1416 3488 cmd.exe 105 PID 3488 wrote to memory of 1416 3488 cmd.exe 105 PID 1936 wrote to memory of 1636 1936 SearchUserHost.exe 106 PID 1936 wrote to memory of 1636 1936 SearchUserHost.exe 106 PID 1636 wrote to memory of 3360 1636 cmd.exe 108 PID 1636 wrote to memory of 3360 1636 cmd.exe 108 PID 1936 wrote to memory of 2944 1936 SearchUserHost.exe 109 PID 1936 wrote to memory of 2944 1936 SearchUserHost.exe 109 PID 2944 wrote to memory of 3028 2944 cmd.exe 111
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\vdduglhies.exe"C:\Users\Admin\AppData\Local\Temp\vdduglhies.exe" "C:\Users\Admin\AppData\Local\Temp\bpvsjddcmm.exe" "C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"4⤵
- Executes dropped EXE
PID:3176
-
-
-
C:\Users\Admin\AppData\Local\Temp\nlpivsqrby.exeC:\Users\Admin\AppData\Local\Temp\nlpivsqrby.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\System32\Identities\bindsvc.exe"C:\Windows\System32\Identities\bindsvc.exe"4⤵
- Executes dropped EXE
PID:368
-
-
C:\Windows\System32\cmd.exe/c sc config msdtc obj= LocalSystem4⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\sc.exesc config msdtc obj= LocalSystem5⤵PID:824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Z7x5JEWS.bat"4⤵PID:2220
-
-
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word2⤵PID:1916
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word2⤵PID:2320
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word2⤵PID:2012
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Word\winword.vbs C:\Users\Admin\AppData\Roaming\Microsoft\Word2⤵PID:4000
-
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\SearchUserHost.exeC:\Windows\system32\SearchUserHost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\cmd.exe/c systeminfo3⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:360
-
-
-
C:\Windows\system32\cmd.exe/c "tasklist /v"3⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\tasklist.exetasklist /v4⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
-
-
C:\Windows\system32\cmd.exe/c "netstat -ano"3⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
-
C:\Windows\system32\cmd.exe/c "ipconfig /all"3⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:2956
-
-
-
C:\Windows\system32\cmd.exe/c "route print"3⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\system32\ROUTE.EXEroute print4⤵PID:1592
-
-
-
C:\Windows\system32\cmd.exe/c "arp -a"3⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\system32\ARP.EXEarp -a4⤵PID:1416
-
-
-
C:\Windows\system32\cmd.exe/c "tasklist /m msfte.dll"3⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\system32\tasklist.exetasklist /m msfte.dll4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
-
C:\Windows\system32\cmd.exe/c "net share"3⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\net.exenet share4⤵PID:3028
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share5⤵PID:1916
-
-
-
-
C:\Windows\system32\cmd.exe/c "ping server"3⤵PID:3676
-
C:\Windows\system32\PING.EXEping server4⤵
- Runs ping.exe
PID:2072
-
-
-
C:\Windows\system32\cmd.exe/c "sc query hfile.sys"3⤵PID:1272
-
C:\Windows\system32\sc.exesc query hfile.sys4⤵PID:2792
-
-
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2024
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 840 844 852 8192 8482⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3956 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3956 -s 18003⤵
- Program crash
PID:1160
-
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 840 844 852 8192 8482⤵
- Modifies data under HKEY_USERS
PID:1244 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1244 -s 10803⤵
- Program crash
PID:1436
-
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 840 844 852 8192 8482⤵
- Modifies data under HKEY_USERS
PID:3372 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3372 -s 15523⤵
- Program crash
PID:3856
-
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 840 844 852 8192 8482⤵PID:2956
-