Analysis
-
max time kernel
90s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
Resource
win10v2004-20220812-en
General
-
Target
cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe
-
Size
78KB
-
MD5
b02a42a3dc16c2f7e971107c7aec01c3
-
SHA1
a12b83983647fb0ed5fb1303f7ff8cd5ded1e699
-
SHA256
cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6
-
SHA512
a840d0e51924ebceaf9411a1d519997cb7e1a8fb18d257fcd18202839d440adbc705a49b2c15af9004420d062ed794baf3c3f22a64c5271978971280335fc7ec
-
SSDEEP
1536:GN9KsMdRp+yAqR4ssWWLN/fcBLjD0IIR05LGBD1hvVL3bBKmo3STBs7:oKf3p+yAqRdy/fQwIhLGBDrvdbBVo3sa
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 848 snss.exe 2236 snss.exe 1020 snss.exe 4132 snss.exe 4992 snss.exe 4784 snss.exe 3556 snss.exe 3808 snss.exe 1288 snss.exe 744 snss.exe 1768 snss.exe 3804 snss.exe 1096 snss.exe 4076 snss.exe 2424 snss.exe 2660 snss.exe 64 snss.exe 1716 snss.exe 4680 snss.exe 4548 snss.exe 2464 snss.exe 640 snss.exe 3172 snss.exe 3308 snss.exe 4604 snss.exe 3680 snss.exe 1636 snss.exe 1744 snss.exe 1064 snss.exe 2596 snss.exe 2568 snss.exe 2336 snss.exe 796 snss.exe 4676 snss.exe 1284 snss.exe 3248 snss.exe 688 snss.exe 5076 snss.exe 3900 snss.exe 1756 snss.exe 2408 snss.exe 4128 snss.exe 1380 snss.exe 5156 snss.exe 5208 snss.exe 5276 snss.exe 5328 snss.exe 5380 snss.exe 5432 snss.exe 5484 snss.exe 5536 snss.exe 5588 snss.exe 5656 snss.exe 5708 snss.exe 5760 snss.exe 5812 snss.exe 5864 snss.exe 5936 snss.exe 5988 snss.exe 6040 snss.exe 6092 snss.exe 3844 snss.exe 5448 snss.exe 5768 snss.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation snss.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\snss = "C:\\Windows\\system32\\snss.exe" snss.exe -
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Lock = "WLEvtLock" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Lock = "WLEvtLock" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Asynchronous = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StopScreenSaver = "WLEvtStopScreenSaver" snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logon = "WLEvtLogon" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\StartScreenSaver = "WLEvtStartScreenSaver" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Startup = "WLEvtStartup" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Unlock = "WLEvtUnlock" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Shutdown = "WLEvtShutdown" snss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Impersonate = "0" snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\DllName = "snss.dll" snss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\snss\Logoff = "WLEvtLogoff" snss.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File created C:\Windows\SysWOW64\snss.exe snss.exe File opened for modification C:\Windows\SysWOW64\snss.dll cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe File created C:\Windows\SysWOW64\snss.exe snss.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ snss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 848 2180 cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe 81 PID 2180 wrote to memory of 848 2180 cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe 81 PID 2180 wrote to memory of 848 2180 cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe 81 PID 848 wrote to memory of 2236 848 snss.exe 82 PID 848 wrote to memory of 2236 848 snss.exe 82 PID 848 wrote to memory of 2236 848 snss.exe 82 PID 2236 wrote to memory of 1020 2236 snss.exe 83 PID 2236 wrote to memory of 1020 2236 snss.exe 83 PID 2236 wrote to memory of 1020 2236 snss.exe 83 PID 1020 wrote to memory of 4132 1020 snss.exe 84 PID 1020 wrote to memory of 4132 1020 snss.exe 84 PID 1020 wrote to memory of 4132 1020 snss.exe 84 PID 4132 wrote to memory of 4992 4132 snss.exe 85 PID 4132 wrote to memory of 4992 4132 snss.exe 85 PID 4132 wrote to memory of 4992 4132 snss.exe 85 PID 4992 wrote to memory of 4784 4992 snss.exe 86 PID 4992 wrote to memory of 4784 4992 snss.exe 86 PID 4992 wrote to memory of 4784 4992 snss.exe 86 PID 4784 wrote to memory of 3556 4784 snss.exe 87 PID 4784 wrote to memory of 3556 4784 snss.exe 87 PID 4784 wrote to memory of 3556 4784 snss.exe 87 PID 3556 wrote to memory of 3808 3556 snss.exe 88 PID 3556 wrote to memory of 3808 3556 snss.exe 88 PID 3556 wrote to memory of 3808 3556 snss.exe 88 PID 3808 wrote to memory of 1288 3808 snss.exe 89 PID 3808 wrote to memory of 1288 3808 snss.exe 89 PID 3808 wrote to memory of 1288 3808 snss.exe 89 PID 1288 wrote to memory of 744 1288 snss.exe 90 PID 1288 wrote to memory of 744 1288 snss.exe 90 PID 1288 wrote to memory of 744 1288 snss.exe 90 PID 744 wrote to memory of 1768 744 snss.exe 91 PID 744 wrote to memory of 1768 744 snss.exe 91 PID 744 wrote to memory of 1768 744 snss.exe 91 PID 1768 wrote to memory of 3804 1768 snss.exe 92 PID 1768 wrote to memory of 3804 1768 snss.exe 92 PID 1768 wrote to memory of 3804 1768 snss.exe 92 PID 3804 wrote to memory of 1096 3804 snss.exe 93 PID 3804 wrote to memory of 1096 3804 snss.exe 93 PID 3804 wrote to memory of 1096 3804 snss.exe 93 PID 1096 wrote to memory of 4076 1096 snss.exe 94 PID 1096 wrote to memory of 4076 1096 snss.exe 94 PID 1096 wrote to memory of 4076 1096 snss.exe 94 PID 4076 wrote to memory of 2424 4076 snss.exe 95 PID 4076 wrote to memory of 2424 4076 snss.exe 95 PID 4076 wrote to memory of 2424 4076 snss.exe 95 PID 2424 wrote to memory of 2660 2424 snss.exe 96 PID 2424 wrote to memory of 2660 2424 snss.exe 96 PID 2424 wrote to memory of 2660 2424 snss.exe 96 PID 2660 wrote to memory of 64 2660 snss.exe 97 PID 2660 wrote to memory of 64 2660 snss.exe 97 PID 2660 wrote to memory of 64 2660 snss.exe 97 PID 64 wrote to memory of 1716 64 snss.exe 98 PID 64 wrote to memory of 1716 64 snss.exe 98 PID 64 wrote to memory of 1716 64 snss.exe 98 PID 1716 wrote to memory of 4680 1716 snss.exe 99 PID 1716 wrote to memory of 4680 1716 snss.exe 99 PID 1716 wrote to memory of 4680 1716 snss.exe 99 PID 4680 wrote to memory of 4548 4680 snss.exe 100 PID 4680 wrote to memory of 4548 4680 snss.exe 100 PID 4680 wrote to memory of 4548 4680 snss.exe 100 PID 4548 wrote to memory of 2464 4548 snss.exe 101 PID 4548 wrote to memory of 2464 4548 snss.exe 101 PID 4548 wrote to memory of 2464 4548 snss.exe 101 PID 2464 wrote to memory of 640 2464 snss.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe"C:\Users\Admin\AppData\Local\Temp\cf2672ad61fb2ddd3097ab05e3287b7b38507d8770dcc459af176080f91315f6.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"17⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"18⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"21⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"22⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"23⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:640 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"24⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3308 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"26⤵
- Executes dropped EXE
- Checks computer location settings
PID:4604 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"27⤵
- Executes dropped EXE
PID:3680 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1636 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"29⤵
- Executes dropped EXE
- Checks computer location settings
PID:1744 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:1064 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2596 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"32⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:2568 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2336 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"34⤵
- Executes dropped EXE
- Modifies WinLogon
PID:796 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:4676 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"36⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:1284 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"37⤵
- Executes dropped EXE
- Checks computer location settings
PID:3248 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"38⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
PID:688 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"39⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
PID:5076 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"40⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:3900 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"41⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1756 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"42⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:2408 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"43⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"44⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:1380 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"45⤵
- Executes dropped EXE
- Modifies registry class
PID:5156 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"46⤵
- Executes dropped EXE
- Modifies registry class
PID:5208 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"47⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:5276 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"48⤵
- Executes dropped EXE
- Modifies registry class
PID:5328 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"49⤵
- Executes dropped EXE
- Modifies registry class
PID:5380 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"50⤵
- Executes dropped EXE
PID:5432 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"51⤵
- Executes dropped EXE
PID:5484 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"52⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:5536 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"53⤵
- Executes dropped EXE
- Modifies WinLogon
PID:5588 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"54⤵
- Executes dropped EXE
PID:5656 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"56⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
PID:5760 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"57⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:5812 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"58⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
PID:5864 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"59⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
PID:5936 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"60⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"61⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"62⤵
- Executes dropped EXE
PID:6092 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"63⤵
- Executes dropped EXE
- Checks computer location settings
PID:3844 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5448 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"65⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
PID:5768 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"66⤵
- Modifies WinLogon
PID:5876 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"67⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:5996 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"68⤵
- Drops file in System32 directory
PID:1680 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"69⤵
- Adds Run key to start application
PID:6184 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"70⤵
- Checks computer location settings
- Drops file in System32 directory
PID:6276 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"71⤵
- Modifies registry class
PID:6320 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"72⤵
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
PID:6376 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"73⤵
- Checks computer location settings
- Modifies registry class
PID:6420 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"74⤵
- Checks computer location settings
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
PID:6464 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"75⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:6508 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"76⤵PID:6552
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"77⤵
- Adds Run key to start application
PID:6636 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"78⤵
- Checks computer location settings
PID:6684 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"79⤵
- Modifies registry class
PID:6728 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"80⤵
- Checks computer location settings
- Modifies WinLogon
PID:6844 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"81⤵
- Checks computer location settings
- Modifies registry class
PID:6892 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"82⤵
- Adds Run key to start application
PID:6964 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"83⤵
- Checks computer location settings
PID:7024 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"84⤵
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
PID:7068 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"85⤵
- Modifies WinLogon
- Drops file in System32 directory
PID:7112 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"86⤵
- Checks computer location settings
- Modifies registry class
PID:7156 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"87⤵
- Checks computer location settings
PID:6236 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"88⤵
- Checks computer location settings
- Modifies registry class
PID:1392 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"89⤵
- Checks computer location settings
- Modifies registry class
PID:7204 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"90⤵
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
PID:7248 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"91⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:7296 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"92⤵
- Adds Run key to start application
PID:7340 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"93⤵
- Modifies registry class
PID:7384 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"94⤵
- Checks computer location settings
- Adds Run key to start application
PID:7428 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"95⤵
- Modifies WinLogon
- Drops file in System32 directory
PID:7472 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"96⤵
- Modifies registry class
PID:7632 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"97⤵
- Checks computer location settings
- Modifies WinLogon
PID:7680 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"98⤵PID:7728
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"99⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:7772 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"100⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
PID:7816 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"101⤵
- Drops file in System32 directory
PID:7884 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"102⤵PID:7928
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"103⤵
- Checks computer location settings
- Modifies WinLogon
PID:7976 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"104⤵
- Modifies registry class
PID:8048 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"105⤵
- Checks computer location settings
PID:8104 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"106⤵
- Checks computer location settings
- Modifies registry class
PID:8152 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"107⤵
- Adds Run key to start application
- Modifies WinLogon
PID:4628 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"108⤵
- Checks computer location settings
- Modifies WinLogon
PID:1632 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"109⤵PID:6616
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"110⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6624 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"111⤵
- Checks computer location settings
PID:1856 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"112⤵
- Modifies registry class
PID:8224 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"113⤵
- Checks computer location settings
- Modifies registry class
PID:8268 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"114⤵
- Modifies WinLogon
- Drops file in System32 directory
PID:8312 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"115⤵
- Adds Run key to start application
PID:8356 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"116⤵PID:8400
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"117⤵
- Adds Run key to start application
- Modifies WinLogon
PID:8444 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"118⤵PID:8488
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"119⤵
- Modifies registry class
PID:8532 -
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"120⤵PID:8576
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"121⤵PID:8620
-
C:\Windows\SysWOW64\snss.exe"C:\Windows\system32\snss.exe"122⤵
- Modifies WinLogon
- Modifies registry class
PID:8664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-