Malware Analysis Report

2025-08-06 03:48

Sample ID 221030-1rpz6sccc6
Target 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
Tags
upx cybergate sality öííé backdoor evasion persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

Threat Level: Known bad

The file 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98 was found to be: Known bad.

Malicious Activity Summary

upx cybergate sality öííé backdoor evasion persistence stealer trojan

Sality

Modifies firewall policy service

UAC bypass

CyberGate, Rebhip

Windows security bypass

UPX packed file

Executes dropped EXE

Modifies Installed Components in the registry

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops file in System32 directory

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Modifies registry class

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-30 21:53

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-30 21:53

Reported

2022-10-31 16:06

Platform

win7-20220812-en

Max time kernel

154s

Max time network

162s

Command Line

C:\Windows\system32\lsass.exe

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe Restart" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\windows\SysWOW64\microsoft\windows.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\windows.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\explorer.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\explorer.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\ C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File created \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Windows\SysWOW64\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\windows\SysWOW64\microsoft\windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\taskhost.exe
PID 1664 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\Dwm.exe
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1664 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\windows\SysWOW64\microsoft\windows.exe N/A

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\System32\smss.exe

\SystemRoot\System32\smss.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

"C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

"C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\windows\SysWOW64\microsoft\windows.exe

"C:\windows\system32\microsoft\windows.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

memory/1664-55-0x0000000000400000-0x000000000046A000-memory.dmp

memory/1664-56-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

memory/1664-57-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

memory/1664-58-0x0000000000290000-0x0000000000292000-memory.dmp

memory/1664-60-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1244-63-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1744-66-0x0000000000000000-mapping.dmp

memory/1744-68-0x0000000075331000-0x0000000075333000-memory.dmp

memory/1664-69-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1744-74-0x0000000024080000-0x00000000240E2000-memory.dmp

\??\c:\windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 0f2e0e5a1878d0e5b150315bda03b2ca
SHA1 ec54908e4cef8b6be4336e009489e77b87d9a390
SHA256 937e46996cc91965b9316ff56ca8d72c97378cb2801c250dc1b1db4668c4281e
SHA512 d77dd735fb71238a730a5feabf4984511e3a656f0cf2980c4f563ed755cd525c7808c74e908bd1dee8e65ed2364714b961b37f8db403d1a444d067cf74648859

memory/1744-77-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

memory/896-83-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

memory/1664-92-0x0000000000400000-0x000000000046A000-memory.dmp

memory/896-91-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1664-86-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1664-94-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

memory/260-93-0x0000000031770000-0x000000003177D000-memory.dmp

memory/896-110-0x00000000240F0000-0x0000000024152000-memory.dmp

\Windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

memory/992-143-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

\Windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

C:\Windows\SYSTEM.INI

MD5 490eb34aab2ccedd6dde230ea0cdc326
SHA1 c92511652c49230cae38634a8e04147baa9dd8f2
SHA256 8ead14fa7da41c149b088db25097dd2062ffb298508964941152666898f2032c
SHA512 481f8523de47c27093f7cadc027ed0226f5ed866018ddfde3340730d849e0023bc217c949c35db1f3b94c63c0118fc1b0c611f0028e4be9075db07e869a3e5c3

memory/896-151-0x0000000005B00000-0x0000000005B6A000-memory.dmp

memory/1744-150-0x00000000318F0000-0x00000000318FD000-memory.dmp

memory/992-152-0x0000000000400000-0x000000000046A000-memory.dmp

memory/992-153-0x0000000001F30000-0x0000000002FBE000-memory.dmp

memory/992-156-0x00000000003D0000-0x00000000003D2000-memory.dmp

memory/896-155-0x00000000049E0000-0x00000000049E2000-memory.dmp

memory/1744-154-0x0000000003B80000-0x0000000003B82000-memory.dmp

memory/992-157-0x0000000000400000-0x000000000046A000-memory.dmp

memory/992-158-0x0000000001F30000-0x0000000002FBE000-memory.dmp

memory/1744-159-0x00000000041D0000-0x000000000525E000-memory.dmp

memory/896-162-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1744-163-0x00000000318F0000-0x00000000318FD000-memory.dmp

memory/1744-164-0x0000000003B80000-0x0000000003B82000-memory.dmp

memory/896-165-0x00000000049E0000-0x00000000049E2000-memory.dmp

memory/1744-166-0x00000000041D0000-0x000000000525E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-30 21:53

Reported

2022-10-31 16:05

Platform

win10v2004-20220812-en

Max time kernel

151s

Max time network

153s

Command Line

C:\Windows\system32\lsass.exe

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe Restart" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{975DDFA4-E4FE-48E7-B7A7-2284EAB42B71}.catalogItem C:\Windows\System32\svchost.exe N/A
File created \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\windows.exe C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File opened for modification \??\c:\windows\SysWOW64\microsoft\ C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EF742C7B-7FE6-43F3-8E21-4F5CF43EFF40}.catalogItem C:\Windows\System32\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\System32\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\System32\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1108 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\fontdrvhost.exe
PID 1108 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\fontdrvhost.exe
PID 1108 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\dwm.exe
PID 1108 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\sihost.exe
PID 1108 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\svchost.exe
PID 1108 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\taskhostw.exe
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\svchost.exe
PID 1108 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\system32\DllHost.exe
PID 1108 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1108 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\System32\RuntimeBroker.exe
PID 1108 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1108 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\System32\RuntimeBroker.exe
PID 1108 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\System32\RuntimeBroker.exe
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE
PID 1108 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe N/A

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -s W32Time

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

"C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

"C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"

C:\windows\SysWOW64\microsoft\windows.exe

"C:\windows\system32\microsoft\windows.exe"

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\System32\wuapihost.exe

C:\Windows\System32\wuapihost.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1108-132-0x0000000000400000-0x000000000046A000-memory.dmp

memory/1108-133-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/1108-134-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/1108-136-0x0000000024010000-0x0000000024072000-memory.dmp

memory/3012-140-0x0000000000000000-mapping.dmp

memory/1108-141-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3012-144-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3012-145-0x0000000024080000-0x00000000240E2000-memory.dmp

\??\c:\windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 0f2e0e5a1878d0e5b150315bda03b2ca
SHA1 ec54908e4cef8b6be4336e009489e77b87d9a390
SHA256 937e46996cc91965b9316ff56ca8d72c97378cb2801c250dc1b1db4668c4281e
SHA512 d77dd735fb71238a730a5feabf4984511e3a656f0cf2980c4f563ed755cd525c7808c74e908bd1dee8e65ed2364714b961b37f8db403d1a444d067cf74648859

memory/1108-149-0x0000000004AD0000-0x0000000004B32000-memory.dmp

memory/3940-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

memory/1108-155-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/3940-158-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1108-159-0x0000000000400000-0x000000000046A000-memory.dmp

memory/1108-160-0x0000000002320000-0x00000000033AE000-memory.dmp

memory/3940-161-0x0000000000400000-0x000000000046A000-memory.dmp

memory/3940-162-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/3012-163-0x0000000031B50000-0x0000000031B5D000-memory.dmp

memory/4932-164-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\microsoft\windows.exe

MD5 915e965cb39c9c14b553ad75aa942307
SHA1 f3a64c310371e3df7384814d870157847c0b9202
SHA256 7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98
SHA512 5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

memory/4932-166-0x0000000031B60000-0x0000000031B6D000-memory.dmp

memory/4932-167-0x0000000002AF0000-0x0000000003B7E000-memory.dmp

memory/4932-168-0x0000000000400000-0x000000000046A000-memory.dmp

memory/4932-169-0x0000000031B60000-0x0000000031B6D000-memory.dmp

memory/3012-170-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/3012-171-0x0000000031B50000-0x0000000031B5D000-memory.dmp