Analysis
-
max time kernel
600s -
max time network
603s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-10-2022 14:44
Static task
static1
Behavioral task
behavioral1
Sample
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe
Resource
win10v2004-20220812-en
General
-
Target
1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe
-
Size
178KB
-
MD5
3c7dc6cd19e758840ed1aa76c8571f67
-
SHA1
5f7b02bd8c8854adfb132817f0edae1771bcdb72
-
SHA256
1d005321c8b45f25e1d012496e4fea43544c6f02af84d28c2c348fd04724d45c
-
SHA512
ee9cf414295a9dbed765a290d6b6dd061e695149670c5809619ef4d3b38f7a1fb7a7e1273d1f3613db322d68e40d7770825eb70890c878b850c5f42477d9b15b
-
SSDEEP
3072:vNcsPrIDUfRgcnOzJn/hJYxqWlDDgbOsSrIf4+udEB:+Y1IJZGzlDtrIcdg
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc Process 90 zirabuo.bazar Process not Found 106 zirabuo.bazar Process not Found 107 zirabuo.bazar Process not Found 115 zirabuo.bazar Process not Found 83 zirabuo.bazar Process not Found 54 zirabuo.bazar Process not Found 59 zirabuo.bazar Process not Found 78 zirabuo.bazar Process not Found 80 zirabuo.bazar Process not Found 81 zirabuo.bazar Process not Found 87 zirabuo.bazar Process not Found 95 zirabuo.bazar Process not Found 48 zirabuo.bazar Process not Found 103 zirabuo.bazar Process not Found 64 zirabuo.bazar Process not Found 65 zirabuo.bazar Process not Found 67 zirabuo.bazar Process not Found 70 zirabuo.bazar Process not Found 71 zirabuo.bazar Process not Found 72 zirabuo.bazar Process not Found 49 zirabuo.bazar Process not Found 114 zirabuo.bazar Process not Found 89 zirabuo.bazar Process not Found 56 zirabuo.bazar Process not Found 62 zirabuo.bazar Process not Found 85 zirabuo.bazar Process not Found 52 zirabuo.bazar Process not Found 116 zirabuo.bazar Process not Found 53 zirabuo.bazar Process not Found 93 zirabuo.bazar Process not Found 113 zirabuo.bazar Process not Found 74 zirabuo.bazar Process not Found 91 zirabuo.bazar Process not Found 68 zirabuo.bazar Process not Found 75 zirabuo.bazar Process not Found 96 zirabuo.bazar Process not Found 111 zirabuo.bazar Process not Found 60 zirabuo.bazar Process not Found 58 zirabuo.bazar Process not Found 66 zirabuo.bazar Process not Found 84 zirabuo.bazar Process not Found 97 zirabuo.bazar Process not Found 100 zirabuo.bazar Process not Found 104 zirabuo.bazar Process not Found Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\SystemCertificates\My 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe 51 zirabuo.bazar Process not Found 101 zirabuo.bazar Process not Found 108 zirabuo.bazar Process not Found 109 zirabuo.bazar Process not Found 112 zirabuo.bazar Process not Found HTTP URL 21 https://85.143.221.85/api/v134 Process not Found 86 zirabuo.bazar Process not Found 99 zirabuo.bazar Process not Found 102 zirabuo.bazar Process not Found 117 zirabuo.bazar Process not Found 76 zirabuo.bazar Process not Found 61 zirabuo.bazar Process not Found 73 zirabuo.bazar Process not Found 105 zirabuo.bazar Process not Found 110 zirabuo.bazar Process not Found 55 zirabuo.bazar Process not Found 98 zirabuo.bazar Process not Found 77 zirabuo.bazar Process not Found 57 zirabuo.bazar Process not Found -
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
description flow ioc 96 zirabuo.bazar 108 zirabuo.bazar 52 zirabuo.bazar 54 zirabuo.bazar 88 zirabuo.bazar 53 zirabuo.bazar 76 zirabuo.bazar 90 zirabuo.bazar 72 zirabuo.bazar 77 zirabuo.bazar 84 zirabuo.bazar 80 zirabuo.bazar 97 zirabuo.bazar 104 zirabuo.bazar 114 zirabuo.bazar 59 zirabuo.bazar 64 zirabuo.bazar 69 zirabuo.bazar 95 zirabuo.bazar 60 zirabuo.bazar 66 zirabuo.bazar 92 zirabuo.bazar 98 zirabuo.bazar 109 zirabuo.bazar 116 zirabuo.bazar 49 zirabuo.bazar 50 zirabuo.bazar 73 zirabuo.bazar 101 zirabuo.bazar 105 zirabuo.bazar 111 zirabuo.bazar 56 zirabuo.bazar 74 zirabuo.bazar 94 zirabuo.bazar 102 zirabuo.bazar 106 zirabuo.bazar 107 zirabuo.bazar 48 zirabuo.bazar 58 zirabuo.bazar 93 zirabuo.bazar 71 zirabuo.bazar 85 zirabuo.bazar 86 zirabuo.bazar 115 zirabuo.bazar HTTP URL 21 https://85.143.221.85/api/v134 62 zirabuo.bazar 68 zirabuo.bazar 51 zirabuo.bazar 57 zirabuo.bazar 113 zirabuo.bazar 112 zirabuo.bazar 75 zirabuo.bazar 100 zirabuo.bazar 103 zirabuo.bazar 82 zirabuo.bazar 99 zirabuo.bazar 67 zirabuo.bazar 81 zirabuo.bazar 110 zirabuo.bazar 117 zirabuo.bazar 65 zirabuo.bazar 78 zirabuo.bazar 83 zirabuo.bazar 91 zirabuo.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 50.3.82.215 Destination IP 35.196.105.24 Destination IP 142.4.204.111 Destination IP 46.101.70.183 Destination IP 91.217.137.37 Destination IP 188.165.200.156 Destination IP 212.24.98.54 Destination IP 51.255.48.78 Destination IP 192.52.166.110 Destination IP 139.59.208.246 Destination IP 51.255.48.78 Destination IP 5.135.183.146 Destination IP 45.63.124.65 Destination IP 89.35.39.64 Destination IP 5.132.191.104 Destination IP 82.141.39.32 Destination IP 82.196.9.45 Destination IP 50.3.82.215 Destination IP 104.238.186.189 Destination IP 139.59.208.246 Destination IP 159.89.249.249 Destination IP 192.52.166.110 Destination IP 66.70.211.246 Destination IP 46.101.70.183 Destination IP 193.183.98.66 Destination IP 69.164.196.21 Destination IP 144.76.133.38 Destination IP 45.71.112.70 Destination IP 163.53.248.170 Destination IP 45.63.124.65 Destination IP 169.239.202.202 Destination IP 198.251.90.143 Destination IP 5.132.191.104 Destination IP 91.217.137.37 Destination IP 185.164.136.225 Destination IP 96.47.228.108 Destination IP 89.35.39.64 Destination IP 193.183.98.66 Destination IP 69.164.196.21 Destination IP 81.2.241.148 Destination IP 139.99.96.146 Destination IP 104.37.195.178 Destination IP 107.172.42.186 Destination IP 142.4.205.47 Destination IP 158.69.160.164 Destination IP 104.238.186.189 Destination IP 111.67.20.8 Destination IP 130.255.78.223 Destination IP 5.45.97.127 Destination IP 188.165.200.156 Destination IP 128.52.130.209 Destination IP 51.254.25.115 Destination IP 5.45.97.127 Destination IP 185.121.177.177 Destination IP 45.71.112.70 Destination IP 185.208.208.141 Destination IP 193.183.98.66 Destination IP 91.217.137.37 Destination IP 46.28.207.199 Destination IP 192.99.85.244 Destination IP 51.254.25.115 Destination IP 144.76.133.38 Destination IP 82.196.9.45 Destination IP 87.98.175.85 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1016 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1016 AUDIODG.EXE Token: 33 1016 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1016 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe"1⤵
- BazarBackdoor
- Modifies system certificate store
PID:2032
-
C:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exeC:\Users\Admin\AppData\Local\Temp\1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b_unpacked.exe {35B42401-D205-4A5C-8F5F-B8DB86EED8C8}1⤵PID:696
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016