Analysis
-
max time kernel
132s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
21-02-2022 22:02
Static task
static1
Behavioral task
behavioral1
Sample
pago copia SWIFT pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
pago copia SWIFT pdf.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
pago copia SWIFT pdf.exe
-
Size
1.8MB
-
MD5
64ce539f8167e9cc887a87f859533933
-
SHA1
a736ba56beb2b342468f36f63e7dce53777dbb34
-
SHA256
f6397532d0b859cf1b26c55f29ec9af49613ce462643d4dc31478c4f231d2833
-
SHA512
d5b763e6259ab3cc9955583ddf20a378de6f73d2286243ee5bb1453244321300ffb9bf274dd45ccf43575ddb83fd0fcd71267e11c4f2c44b0b868a905ff59e21
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
pago copia SWIFT pdf.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url pago copia SWIFT pdf.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
pago copia SWIFT pdf.exepid process 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 4400 svchost.exe Token: SeCreatePagefilePrivilege 4400 svchost.exe Token: SeShutdownPrivilege 4400 svchost.exe Token: SeCreatePagefilePrivilege 4400 svchost.exe Token: SeShutdownPrivilege 4400 svchost.exe Token: SeCreatePagefilePrivilege 4400 svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
pago copia SWIFT pdf.exepid process 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
pago copia SWIFT pdf.exepid process 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe 2588 pago copia SWIFT pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
pago copia SWIFT pdf.exedescription pid process target process PID 2588 wrote to memory of 5036 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 5036 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 5036 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 360 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 360 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 360 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4776 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4776 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4776 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4796 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4796 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4796 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 5000 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 5000 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 5000 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4292 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4292 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4292 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4300 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4300 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4300 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4272 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4272 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4272 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4748 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4748 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4748 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 952 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 952 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 952 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 948 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 948 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 948 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4312 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4312 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4312 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1236 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1236 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1236 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1240 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1240 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1240 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 3120 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 3120 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 3120 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4664 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4664 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 4664 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1296 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1396 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1396 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1396 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 2308 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 2308 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 2308 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1556 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1556 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 1556 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe PID 2588 wrote to memory of 2240 2588 pago copia SWIFT pdf.exe pago copia SWIFT pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"1⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"C:\Users\Admin\AppData\Local\Temp\pago copia SWIFT pdf.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2588-130-0x00000000039A0000-0x00000000039CD000-memory.dmpFilesize
180KB
-
memory/2588-131-0x0000000001F30000-0x0000000001F33000-memory.dmpFilesize
12KB
-
memory/4400-132-0x000002057F160000-0x000002057F170000-memory.dmpFilesize
64KB
-
memory/4400-133-0x000002057F720000-0x000002057F730000-memory.dmpFilesize
64KB
-
memory/4400-134-0x000002057FDE0000-0x000002057FDE4000-memory.dmpFilesize
16KB