Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 02:44
Behavioral task
behavioral1
Sample
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
Resource
win10v2004-20220812-en
General
-
Target
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe
-
Size
99KB
-
MD5
7a3c3fc3693cd7fa613e5ea8f204bf40
-
SHA1
7b85325a5fdb808b30a0328325761d5b8d2f555c
-
SHA256
9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1
-
SHA512
11ef32be04ad3c1af2f94e2bd7bfd91456da50580a94ba23bea3b33a050a3d6ec09d3642ff9ce544db3b49295fd6dbe1b4cd9f219d11c4770e5c74c048fa58cf
-
SSDEEP
1536:32R41Jrt6Bi48Bcf1PJsQN7jDQqLDTysHrEnQ1g3:GPxGWvpDvE/3
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2044 3MW2BkP.exe 972 3MW2BkP.exe 656 3MW2BkP.exe 2000 3MW2BkP.exe 1052 3MW2BkP.exe 1520 3MW2BkP.exe 1412 3MW2BkP.exe 612 3MW2BkP.exe 1160 3MW2BkP.exe 1464 3MW2BkP.exe 1180 3MW2BkP.exe 1960 3MW2BkP.exe 1816 3MW2BkP.exe 824 3MW2BkP.exe 1392 3MW2BkP.exe 1144 3MW2BkP.exe 1096 3MW2BkP.exe 1952 3MW2BkP.exe 1664 3MW2BkP.exe 1708 3MW2BkP.exe 1964 3MW2BkP.exe 1728 3MW2BkP.exe 1440 3MW2BkP.exe 1472 3MW2BkP.exe 968 3MW2BkP.exe 1928 3MW2BkP.exe 1060 3MW2BkP.exe 1384 3MW2BkP.exe 2036 3MW2BkP.exe 1604 3MW2BkP.exe 1132 3MW2BkP.exe 336 3MW2BkP.exe 1080 3MW2BkP.exe 1564 3MW2BkP.exe 1892 3MW2BkP.exe 764 3MW2BkP.exe 756 3MW2BkP.exe 1736 3MW2BkP.exe 1444 3MW2BkP.exe 2040 3MW2BkP.exe 1788 3MW2BkP.exe 1936 3MW2BkP.exe 1780 3MW2BkP.exe 1540 3MW2BkP.exe 992 3MW2BkP.exe 1984 3MW2BkP.exe 980 3MW2BkP.exe 1720 3MW2BkP.exe 1688 3MW2BkP.exe 1636 3MW2BkP.exe 1460 3MW2BkP.exe 1568 3MW2BkP.exe 1924 3MW2BkP.exe 2076 3MW2BkP.exe 2120 3MW2BkP.exe 2168 3MW2BkP.exe 2212 3MW2BkP.exe 2252 3MW2BkP.exe 2276 3MW2BkP.exe 2296 3MW2BkP.exe 2316 3MW2BkP.exe 2336 3MW2BkP.exe 2356 3MW2BkP.exe 2376 3MW2BkP.exe -
resource yara_rule behavioral1/memory/2016-55-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/files/0x000900000001422b-56.dat upx behavioral1/files/0x000900000001422b-57.dat upx behavioral1/files/0x000900000001422b-59.dat upx behavioral1/files/0x000900000001422b-61.dat upx behavioral1/memory/2044-66-0x0000000000400000-0x0000000000444000-memory.dmp upx behavioral1/files/0x000900000001422b-64.dat upx behavioral1/files/0x000900000001422b-62.dat upx behavioral1/files/0x000900000001422b-68.dat upx behavioral1/files/0x000900000001422b-70.dat upx behavioral1/files/0x000900000001422b-71.dat upx behavioral1/files/0x000900000001422b-73.dat upx behavioral1/files/0x000900000001422b-76.dat upx behavioral1/files/0x000900000001422b-78.dat upx behavioral1/files/0x000900000001422b-75.dat upx behavioral1/files/0x000900000001422b-80.dat upx behavioral1/files/0x000900000001422b-81.dat upx behavioral1/files/0x000900000001422b-83.dat upx behavioral1/files/0x000900000001422b-85.dat upx behavioral1/files/0x000900000001422b-86.dat upx behavioral1/files/0x000900000001422b-88.dat upx behavioral1/files/0x000900000001422b-90.dat upx behavioral1/files/0x000900000001422b-91.dat upx behavioral1/files/0x000900000001422b-93.dat upx behavioral1/files/0x000900000001422b-96.dat upx behavioral1/files/0x000900000001422b-95.dat upx behavioral1/files/0x000900000001422b-98.dat upx behavioral1/files/0x000900000001422b-100.dat upx behavioral1/files/0x000900000001422b-101.dat upx behavioral1/files/0x000900000001422b-103.dat upx behavioral1/files/0x000900000001422b-106.dat upx behavioral1/files/0x000900000001422b-105.dat upx behavioral1/files/0x000900000001422b-108.dat upx behavioral1/files/0x000900000001422b-110.dat upx behavioral1/files/0x000900000001422b-111.dat upx behavioral1/files/0x000900000001422b-113.dat upx behavioral1/files/0x000900000001422b-115.dat upx behavioral1/files/0x000900000001422b-116.dat upx behavioral1/files/0x000900000001422b-118.dat upx behavioral1/files/0x000900000001422b-120.dat upx behavioral1/files/0x000900000001422b-121.dat upx behavioral1/files/0x000900000001422b-123.dat upx behavioral1/files/0x000900000001422b-126.dat upx behavioral1/files/0x000900000001422b-125.dat upx behavioral1/files/0x000900000001422b-128.dat upx behavioral1/files/0x000900000001422b-130.dat upx behavioral1/files/0x000900000001422b-131.dat upx behavioral1/files/0x000900000001422b-133.dat upx behavioral1/files/0x000900000001422b-136.dat upx behavioral1/files/0x000900000001422b-135.dat upx behavioral1/files/0x000900000001422b-138.dat upx behavioral1/files/0x000900000001422b-140.dat upx behavioral1/files/0x000900000001422b-141.dat upx behavioral1/files/0x000900000001422b-143.dat upx behavioral1/files/0x000900000001422b-145.dat upx behavioral1/files/0x000900000001422b-146.dat upx behavioral1/files/0x000900000001422b-148.dat upx behavioral1/files/0x000900000001422b-150.dat upx behavioral1/files/0x000900000001422b-151.dat upx behavioral1/files/0x000900000001422b-153.dat upx behavioral1/files/0x000900000001422b-155.dat upx behavioral1/files/0x000900000001422b-156.dat upx behavioral1/files/0x000900000001422b-158.dat upx behavioral1/memory/972-161-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Loads dropped DLL 64 IoCs
pid Process 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 2044 3MW2BkP.exe 2044 3MW2BkP.exe 972 3MW2BkP.exe 972 3MW2BkP.exe 656 3MW2BkP.exe 656 3MW2BkP.exe 2000 3MW2BkP.exe 2000 3MW2BkP.exe 1052 3MW2BkP.exe 1052 3MW2BkP.exe 1520 3MW2BkP.exe 1520 3MW2BkP.exe 1412 3MW2BkP.exe 1412 3MW2BkP.exe 612 3MW2BkP.exe 612 3MW2BkP.exe 1160 3MW2BkP.exe 1160 3MW2BkP.exe 1464 3MW2BkP.exe 1464 3MW2BkP.exe 1180 3MW2BkP.exe 1180 3MW2BkP.exe 1960 3MW2BkP.exe 1960 3MW2BkP.exe 1816 3MW2BkP.exe 1816 3MW2BkP.exe 824 3MW2BkP.exe 824 3MW2BkP.exe 1392 3MW2BkP.exe 1392 3MW2BkP.exe 1144 3MW2BkP.exe 1144 3MW2BkP.exe 1096 3MW2BkP.exe 1096 3MW2BkP.exe 1952 3MW2BkP.exe 1952 3MW2BkP.exe 1664 3MW2BkP.exe 1664 3MW2BkP.exe 1708 3MW2BkP.exe 1708 3MW2BkP.exe 1964 3MW2BkP.exe 1964 3MW2BkP.exe 1728 3MW2BkP.exe 1728 3MW2BkP.exe 1440 3MW2BkP.exe 1440 3MW2BkP.exe 1472 3MW2BkP.exe 1472 3MW2BkP.exe 968 3MW2BkP.exe 968 3MW2BkP.exe 1928 3MW2BkP.exe 1928 3MW2BkP.exe 1060 3MW2BkP.exe 1060 3MW2BkP.exe 1384 3MW2BkP.exe 1384 3MW2BkP.exe 2036 3MW2BkP.exe 2036 3MW2BkP.exe 1604 3MW2BkP.exe 1604 3MW2BkP.exe 1132 3MW2BkP.exe 1132 3MW2BkP.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: 3MW2BkP.exe File opened (read-only) \??\e: 3MW2BkP.exe File opened (read-only) \??\q: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\i: 3MW2BkP.exe File opened (read-only) \??\v: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\r: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\t: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\p: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\l: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\h: 3MW2BkP.exe File opened (read-only) \??\x: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\s: 3MW2BkP.exe File opened (read-only) \??\v: 3MW2BkP.exe File opened (read-only) \??\e: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\j: 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe File opened (read-only) \??\q: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\t: 3MW2BkP.exe File opened (read-only) \??\o: 3MW2BkP.exe File opened (read-only) \??\e: 3MW2BkP.exe File opened (read-only) \??\r: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\n: 3MW2BkP.exe File opened (read-only) \??\j: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\z: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\y: 3MW2BkP.exe File opened (read-only) \??\k: 3MW2BkP.exe File opened (read-only) \??\u: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\w: 3MW2BkP.exe File opened (read-only) \??\k: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\q: 3MW2BkP.exe File opened (read-only) \??\z: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\r: 3MW2BkP.exe File opened (read-only) \??\t: 3MW2BkP.exe File opened (read-only) \??\g: 3MW2BkP.exe File opened (read-only) \??\x: 3MW2BkP.exe File opened (read-only) \??\f: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe File opened (read-only) \??\m: 3MW2BkP.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File opened for modification C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exe 3MW2BkP.exe File created C:\Windows\SysWOW64\3MW2BkP\FMjAUvT.exe 3MW2BkP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe Token: SeLoadDriverPrivilege 2044 3MW2BkP.exe Token: SeLoadDriverPrivilege 972 3MW2BkP.exe Token: SeLoadDriverPrivilege 656 3MW2BkP.exe Token: SeLoadDriverPrivilege 2000 3MW2BkP.exe Token: SeLoadDriverPrivilege 1052 3MW2BkP.exe Token: SeLoadDriverPrivilege 1520 3MW2BkP.exe Token: SeLoadDriverPrivilege 1412 3MW2BkP.exe Token: SeLoadDriverPrivilege 612 3MW2BkP.exe Token: SeLoadDriverPrivilege 1160 3MW2BkP.exe Token: SeLoadDriverPrivilege 1464 3MW2BkP.exe Token: SeLoadDriverPrivilege 1180 3MW2BkP.exe Token: SeLoadDriverPrivilege 1960 3MW2BkP.exe Token: SeLoadDriverPrivilege 1816 3MW2BkP.exe Token: SeLoadDriverPrivilege 824 3MW2BkP.exe Token: SeLoadDriverPrivilege 1392 3MW2BkP.exe Token: SeLoadDriverPrivilege 1144 3MW2BkP.exe Token: SeLoadDriverPrivilege 1096 3MW2BkP.exe Token: SeLoadDriverPrivilege 1952 3MW2BkP.exe Token: SeLoadDriverPrivilege 1664 3MW2BkP.exe Token: SeLoadDriverPrivilege 1708 3MW2BkP.exe Token: SeLoadDriverPrivilege 1964 3MW2BkP.exe Token: SeLoadDriverPrivilege 1728 3MW2BkP.exe Token: SeLoadDriverPrivilege 1440 3MW2BkP.exe Token: SeLoadDriverPrivilege 1472 3MW2BkP.exe Token: SeLoadDriverPrivilege 968 3MW2BkP.exe Token: SeLoadDriverPrivilege 1928 3MW2BkP.exe Token: SeLoadDriverPrivilege 1060 3MW2BkP.exe Token: SeLoadDriverPrivilege 1384 3MW2BkP.exe Token: SeLoadDriverPrivilege 2036 3MW2BkP.exe Token: SeLoadDriverPrivilege 1604 3MW2BkP.exe Token: SeLoadDriverPrivilege 1132 3MW2BkP.exe Token: SeLoadDriverPrivilege 336 3MW2BkP.exe Token: SeLoadDriverPrivilege 1080 3MW2BkP.exe Token: SeLoadDriverPrivilege 1564 3MW2BkP.exe Token: SeLoadDriverPrivilege 1892 3MW2BkP.exe Token: SeLoadDriverPrivilege 764 3MW2BkP.exe Token: SeLoadDriverPrivilege 756 3MW2BkP.exe Token: SeLoadDriverPrivilege 1736 3MW2BkP.exe Token: SeLoadDriverPrivilege 1444 3MW2BkP.exe Token: SeLoadDriverPrivilege 2040 3MW2BkP.exe Token: SeLoadDriverPrivilege 1788 3MW2BkP.exe Token: SeLoadDriverPrivilege 1936 3MW2BkP.exe Token: SeLoadDriverPrivilege 1780 3MW2BkP.exe Token: SeLoadDriverPrivilege 1540 3MW2BkP.exe Token: SeLoadDriverPrivilege 992 3MW2BkP.exe Token: SeLoadDriverPrivilege 1984 3MW2BkP.exe Token: SeLoadDriverPrivilege 980 3MW2BkP.exe Token: SeLoadDriverPrivilege 1720 3MW2BkP.exe Token: SeLoadDriverPrivilege 1688 3MW2BkP.exe Token: SeLoadDriverPrivilege 1636 3MW2BkP.exe Token: SeLoadDriverPrivilege 1460 3MW2BkP.exe Token: SeLoadDriverPrivilege 1568 3MW2BkP.exe Token: SeLoadDriverPrivilege 1924 3MW2BkP.exe Token: SeLoadDriverPrivilege 2076 3MW2BkP.exe Token: SeLoadDriverPrivilege 2120 3MW2BkP.exe Token: SeLoadDriverPrivilege 2168 3MW2BkP.exe Token: SeLoadDriverPrivilege 2212 3MW2BkP.exe Token: SeLoadDriverPrivilege 2252 3MW2BkP.exe Token: SeLoadDriverPrivilege 2276 3MW2BkP.exe Token: SeLoadDriverPrivilege 2296 3MW2BkP.exe Token: SeLoadDriverPrivilege 2316 3MW2BkP.exe Token: SeLoadDriverPrivilege 2336 3MW2BkP.exe Token: SeLoadDriverPrivilege 2356 3MW2BkP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2044 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 26 PID 2016 wrote to memory of 2044 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 26 PID 2016 wrote to memory of 2044 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 26 PID 2016 wrote to memory of 2044 2016 9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe 26 PID 2044 wrote to memory of 972 2044 3MW2BkP.exe 27 PID 2044 wrote to memory of 972 2044 3MW2BkP.exe 27 PID 2044 wrote to memory of 972 2044 3MW2BkP.exe 27 PID 2044 wrote to memory of 972 2044 3MW2BkP.exe 27 PID 972 wrote to memory of 656 972 3MW2BkP.exe 28 PID 972 wrote to memory of 656 972 3MW2BkP.exe 28 PID 972 wrote to memory of 656 972 3MW2BkP.exe 28 PID 972 wrote to memory of 656 972 3MW2BkP.exe 28 PID 656 wrote to memory of 2000 656 3MW2BkP.exe 29 PID 656 wrote to memory of 2000 656 3MW2BkP.exe 29 PID 656 wrote to memory of 2000 656 3MW2BkP.exe 29 PID 656 wrote to memory of 2000 656 3MW2BkP.exe 29 PID 2000 wrote to memory of 1052 2000 3MW2BkP.exe 30 PID 2000 wrote to memory of 1052 2000 3MW2BkP.exe 30 PID 2000 wrote to memory of 1052 2000 3MW2BkP.exe 30 PID 2000 wrote to memory of 1052 2000 3MW2BkP.exe 30 PID 1052 wrote to memory of 1520 1052 3MW2BkP.exe 31 PID 1052 wrote to memory of 1520 1052 3MW2BkP.exe 31 PID 1052 wrote to memory of 1520 1052 3MW2BkP.exe 31 PID 1052 wrote to memory of 1520 1052 3MW2BkP.exe 31 PID 1520 wrote to memory of 1412 1520 3MW2BkP.exe 32 PID 1520 wrote to memory of 1412 1520 3MW2BkP.exe 32 PID 1520 wrote to memory of 1412 1520 3MW2BkP.exe 32 PID 1520 wrote to memory of 1412 1520 3MW2BkP.exe 32 PID 1412 wrote to memory of 612 1412 3MW2BkP.exe 33 PID 1412 wrote to memory of 612 1412 3MW2BkP.exe 33 PID 1412 wrote to memory of 612 1412 3MW2BkP.exe 33 PID 1412 wrote to memory of 612 1412 3MW2BkP.exe 33 PID 612 wrote to memory of 1160 612 3MW2BkP.exe 34 PID 612 wrote to memory of 1160 612 3MW2BkP.exe 34 PID 612 wrote to memory of 1160 612 3MW2BkP.exe 34 PID 612 wrote to memory of 1160 612 3MW2BkP.exe 34 PID 1160 wrote to memory of 1464 1160 3MW2BkP.exe 35 PID 1160 wrote to memory of 1464 1160 3MW2BkP.exe 35 PID 1160 wrote to memory of 1464 1160 3MW2BkP.exe 35 PID 1160 wrote to memory of 1464 1160 3MW2BkP.exe 35 PID 1464 wrote to memory of 1180 1464 3MW2BkP.exe 36 PID 1464 wrote to memory of 1180 1464 3MW2BkP.exe 36 PID 1464 wrote to memory of 1180 1464 3MW2BkP.exe 36 PID 1464 wrote to memory of 1180 1464 3MW2BkP.exe 36 PID 1180 wrote to memory of 1960 1180 3MW2BkP.exe 37 PID 1180 wrote to memory of 1960 1180 3MW2BkP.exe 37 PID 1180 wrote to memory of 1960 1180 3MW2BkP.exe 37 PID 1180 wrote to memory of 1960 1180 3MW2BkP.exe 37 PID 1960 wrote to memory of 1816 1960 3MW2BkP.exe 38 PID 1960 wrote to memory of 1816 1960 3MW2BkP.exe 38 PID 1960 wrote to memory of 1816 1960 3MW2BkP.exe 38 PID 1960 wrote to memory of 1816 1960 3MW2BkP.exe 38 PID 1816 wrote to memory of 824 1816 3MW2BkP.exe 39 PID 1816 wrote to memory of 824 1816 3MW2BkP.exe 39 PID 1816 wrote to memory of 824 1816 3MW2BkP.exe 39 PID 1816 wrote to memory of 824 1816 3MW2BkP.exe 39 PID 824 wrote to memory of 1392 824 3MW2BkP.exe 40 PID 824 wrote to memory of 1392 824 3MW2BkP.exe 40 PID 824 wrote to memory of 1392 824 3MW2BkP.exe 40 PID 824 wrote to memory of 1392 824 3MW2BkP.exe 40 PID 1392 wrote to memory of 1144 1392 3MW2BkP.exe 41 PID 1392 wrote to memory of 1144 1392 3MW2BkP.exe 41 PID 1392 wrote to memory of 1144 1392 3MW2BkP.exe 41 PID 1392 wrote to memory of 1144 1392 3MW2BkP.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe"C:\Users\Admin\AppData\Local\Temp\9104f5f1bafa3fa6ef6fe01da9f021599f3a6b03081ea993cf95909637da92c1.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1664 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1928 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2036 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1132 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:336 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe34⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:756 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe39⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1444 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe41⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe42⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1788 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe43⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe44⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:992 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe47⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe48⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe49⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe50⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe52⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe54⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe55⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe57⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe58⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe62⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2356 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe66⤵
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe67⤵
- Enumerates connected drives
PID:2412 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe68⤵
- Enumerates connected drives
PID:2428 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe69⤵
- Enumerates connected drives
PID:2444 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe70⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe71⤵
- Drops file in System32 directory
PID:2476 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe72⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe73⤵
- Enumerates connected drives
PID:2508 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe74⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe75⤵PID:2540
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe76⤵PID:2556
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe77⤵
- Enumerates connected drives
PID:2572 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe78⤵PID:2588
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe79⤵
- Enumerates connected drives
PID:2604 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe80⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe81⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2636 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe82⤵
- Drops file in System32 directory
PID:2652 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe83⤵PID:2668
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe84⤵
- Drops file in System32 directory
PID:2684 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe85⤵PID:2700
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe86⤵PID:2716
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe87⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2732 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe88⤵PID:2748
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe89⤵PID:2764
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe90⤵
- Enumerates connected drives
PID:2780 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe91⤵PID:2796
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe92⤵
- Enumerates connected drives
PID:2812 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe93⤵
- Drops file in System32 directory
PID:2828 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe94⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe95⤵
- Drops file in System32 directory
PID:2860 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe96⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe97⤵PID:2892
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe98⤵
- Enumerates connected drives
PID:2908 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe99⤵PID:2924
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe100⤵
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe101⤵
- Enumerates connected drives
PID:2956 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe102⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe103⤵PID:2988
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe104⤵PID:3004
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe105⤵PID:3020
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe106⤵PID:3036
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe107⤵PID:3052
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe108⤵PID:3068
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe109⤵PID:568
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe110⤵PID:2104
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe111⤵PID:2100
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe112⤵PID:2116
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe113⤵PID:2132
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe114⤵PID:2156
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe115⤵PID:2184
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe116⤵PID:2192
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe117⤵PID:2220
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe118⤵PID:2236
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe119⤵PID:2284
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe120⤵PID:2328
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe121⤵PID:2368
-
C:\Windows\SysWOW64\FMjAUvT\3MW2BkP.exeC:\Windows\system32\FMjAUvT\3MW2BkP.exe122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-