Analysis
-
max time kernel
141s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17-04-2022 07:50
Static task
static1
Behavioral task
behavioral1
Sample
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
Resource
win10v2004-20220414-en
General
-
Target
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
-
Size
1.1MB
-
MD5
5129c4871c5c6e7f6233e9fe21346a6b
-
SHA1
c81cce9a933a5c6ca3eb458f3d1a0c04a792d117
-
SHA256
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e
-
SHA512
a0c702d8814707e05212fa09942140bee5833680842489157e05d54cdd39af7b385e585b984c0ea4978aefdd88b46b15ee26afa3e74e1184fb9f0d7866383d4a
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4384-140-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription pid process target process PID 2260 set thread context of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exepid process 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exepowershell.exepid process 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 3768 powershell.exe 3768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exepowershell.exedescription pid process Token: SeDebugPrivilege 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Token: SeDebugPrivilege 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe Token: SeDebugPrivilege 3768 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exepid process 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription pid process target process PID 2260 wrote to memory of 2000 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 2000 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 2000 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4268 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4268 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4268 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4188 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4188 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4188 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 2260 wrote to memory of 4384 2260 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe PID 4384 wrote to memory of 3768 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe powershell.exe PID 4384 wrote to memory of 3768 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe powershell.exe PID 4384 wrote to memory of 3768 4384 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe -
outlook_win_path 1 IoCs
Processes:
874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"2⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"2⤵PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"2⤵PID:4188
-
-
C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4384 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\874a4dddd1951fe84c5a379b64f9304198c045b58f668020cc93c6748429202e.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-