Analysis
-
max time kernel
68s -
max time network
8s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe
-
Size
75KB
-
MD5
7a7ace486dbb046f588331a08e869d58
-
SHA1
b92149f046f00bb69de329b8457d32c24726ee00
-
SHA256
ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910
-
SHA512
0dc9d36b727e1a79df7b60648fa35a74a9e0d705cfde274606b68d6770e2fd04e7438d09b5be6f5be135f7192114438b99246b617e64144c36b5df7fb81fbd2d
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\ImagePath ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\ImagePath ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\ImagePath ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\ImagePath ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe -
Sets service image path in registry 2 TTPs
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2361464256-2201551969-2316606395-1000\desktop.ini ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\7-Zip\7z.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe 3804 ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 6024 Process not Found 6052 Process not Found 6060 Process not Found 6068 Process not Found 6076 Process not Found 6084 Process not Found 6092 Process not Found 6100 Process not Found 6108 Process not Found 6116 Process not Found 6124 Process not Found 6132 Process not Found 6140 Process not Found 5852 Process not Found 2564 Process not Found 3044 Process not Found 2880 Process not Found 5876 Process not Found 2036 Process not Found 2584 Process not Found 3380 Process not Found 3584 Process not Found 3340 Process not Found 2424 Process not Found 2532 Process not Found 2556 Process not Found 3820 Process not Found 2620 Process not Found 3812 Process not Found 60 Process not Found 3496 Process not Found 3904 Process not Found 3412 Process not Found 3392 Process not Found 3444 Process not Found 2900 Process not Found 2988 Process not Found 1836 Process not Found 3264 Process not Found 992 Process not Found 2896 Process not Found 2908 Process not Found 2248 Process not Found 432 Process not Found 2004 Process not Found 2612 Process not Found 2420 Process not Found 5924 Process not Found 588 Process not Found 676 Process not Found 648 Process not Found 720 Process not Found 680 Process not Found 2472 Process not Found 5936 Process not Found 436 Process not Found 1392 Process not Found 1480 Process not Found 2340 Process not Found 1288 Process not Found 984 Process not Found 2292 Process not Found 2364 Process not Found 1308 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5868 sihost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe"C:\Users\Admin\AppData\Local\Temp\ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910.exe"1⤵
- Modifies security service
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:5868