Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe
Resource
win10v2004-20220901-en
General
-
Target
e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe
-
Size
490KB
-
MD5
444ee2042336db25a124b2e6badc61c0
-
SHA1
74c2ae1e70cfb8a208861702b0a5bfe67ca44397
-
SHA256
e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4
-
SHA512
690972ec07ea0dc7a55e909e385668a35c2c1848895427659847b594f0ab467c3f62bb58588421b4e8dc3f1e5ba6f9df07b54164ea89b18b9007d8f0ee8fdb64
-
SSDEEP
12288:N///edkn3/upJiI+qx6Xw2Xvyr0HHJAeODgm+:5/UkPuWqww2q/HDP+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\PYIEsEAY\\CessUQEY.exe," e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\PYIEsEAY\\CessUQEY.exe," e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3368 YgosIYMk.exe 2992 CessUQEY.exe 1560 zesEAYow.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation YgosIYMk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CessUQEY.exe = "C:\\ProgramData\\PYIEsEAY\\CessUQEY.exe" e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CessUQEY.exe = "C:\\ProgramData\\PYIEsEAY\\CessUQEY.exe" CessUQEY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CessUQEY.exe = "C:\\ProgramData\\PYIEsEAY\\CessUQEY.exe" zesEAYow.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YgosIYMk.exe = "C:\\Users\\Admin\\yQEcQQQQ\\YgosIYMk.exe" e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YgosIYMk.exe = "C:\\Users\\Admin\\yQEcQQQQ\\YgosIYMk.exe" YgosIYMk.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\yQEcQQQQ zesEAYow.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\yQEcQQQQ\YgosIYMk zesEAYow.exe File created C:\Windows\SysWOW64\shell32.dll.exe YgosIYMk.exe File opened for modification C:\Windows\SysWOW64\sheOpenUninstall.gif YgosIYMk.exe File opened for modification C:\Windows\SysWOW64\sheSetConvertTo.gif YgosIYMk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 4112 reg.exe 4884 reg.exe 3340 reg.exe 4968 reg.exe 3772 reg.exe 1592 reg.exe 3596 reg.exe 1500 reg.exe 3984 reg.exe 528 reg.exe 4144 reg.exe 100 reg.exe 336 reg.exe 1652 reg.exe 2704 reg.exe 368 reg.exe 3312 reg.exe 3024 reg.exe 3208 reg.exe 3484 reg.exe 4324 reg.exe 824 reg.exe 1916 reg.exe 4728 reg.exe 3440 reg.exe 4012 reg.exe 4704 reg.exe 912 reg.exe 1704 reg.exe 3784 reg.exe 2664 reg.exe 5116 reg.exe 796 reg.exe 3976 reg.exe 1988 reg.exe 4860 reg.exe 5056 reg.exe 4756 reg.exe 1908 reg.exe 5088 reg.exe 1392 reg.exe 4612 reg.exe 3208 reg.exe 1648 reg.exe 1152 reg.exe 4124 reg.exe 4956 reg.exe 3580 reg.exe 2584 reg.exe 4328 reg.exe 2952 reg.exe 4520 reg.exe 2400 reg.exe 4396 reg.exe 3724 reg.exe 3124 reg.exe 2568 reg.exe 4996 reg.exe 3824 reg.exe 1420 reg.exe 1176 reg.exe 5076 reg.exe 4524 reg.exe 4828 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3376 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3376 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3376 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3376 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3896 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3896 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3896 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3896 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1920 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1920 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1920 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1920 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 724 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 724 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 724 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 724 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4556 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4556 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4556 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4556 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1612 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1612 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1612 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1612 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3660 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3660 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3660 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3660 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 176 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 176 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 176 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 176 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1692 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1692 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1692 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 1692 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4188 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4188 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4188 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 4188 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3468 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3468 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3468 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3468 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3340 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3340 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3340 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 3340 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3368 YgosIYMk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe 3368 YgosIYMk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3368 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 82 PID 4952 wrote to memory of 3368 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 82 PID 4952 wrote to memory of 3368 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 82 PID 4952 wrote to memory of 2992 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 83 PID 4952 wrote to memory of 2992 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 83 PID 4952 wrote to memory of 2992 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 83 PID 4952 wrote to memory of 1872 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 85 PID 4952 wrote to memory of 1872 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 85 PID 4952 wrote to memory of 1872 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 85 PID 4952 wrote to memory of 3100 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 87 PID 4952 wrote to memory of 3100 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 87 PID 4952 wrote to memory of 3100 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 87 PID 4952 wrote to memory of 4864 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 88 PID 4952 wrote to memory of 4864 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 88 PID 4952 wrote to memory of 4864 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 88 PID 4952 wrote to memory of 3724 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 91 PID 4952 wrote to memory of 3724 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 91 PID 4952 wrote to memory of 3724 4952 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 91 PID 1872 wrote to memory of 1060 1872 cmd.exe 93 PID 1872 wrote to memory of 1060 1872 cmd.exe 93 PID 1872 wrote to memory of 1060 1872 cmd.exe 93 PID 1060 wrote to memory of 336 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 94 PID 1060 wrote to memory of 336 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 94 PID 1060 wrote to memory of 336 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 94 PID 1060 wrote to memory of 2268 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 96 PID 1060 wrote to memory of 2268 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 96 PID 1060 wrote to memory of 2268 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 96 PID 1060 wrote to memory of 5004 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 97 PID 1060 wrote to memory of 5004 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 97 PID 1060 wrote to memory of 5004 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 97 PID 1060 wrote to memory of 3804 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 98 PID 1060 wrote to memory of 3804 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 98 PID 1060 wrote to memory of 3804 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 98 PID 1060 wrote to memory of 544 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 99 PID 1060 wrote to memory of 544 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 99 PID 1060 wrote to memory of 544 1060 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 99 PID 336 wrote to memory of 440 336 cmd.exe 104 PID 336 wrote to memory of 440 336 cmd.exe 104 PID 336 wrote to memory of 440 336 cmd.exe 104 PID 544 wrote to memory of 4368 544 cmd.exe 105 PID 544 wrote to memory of 4368 544 cmd.exe 105 PID 544 wrote to memory of 4368 544 cmd.exe 105 PID 440 wrote to memory of 4348 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 106 PID 440 wrote to memory of 4348 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 106 PID 440 wrote to memory of 4348 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 106 PID 4348 wrote to memory of 1460 4348 cmd.exe 108 PID 4348 wrote to memory of 1460 4348 cmd.exe 108 PID 4348 wrote to memory of 1460 4348 cmd.exe 108 PID 440 wrote to memory of 1428 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 109 PID 440 wrote to memory of 1428 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 109 PID 440 wrote to memory of 1428 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 109 PID 440 wrote to memory of 2820 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 110 PID 440 wrote to memory of 2820 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 110 PID 440 wrote to memory of 2820 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 110 PID 440 wrote to memory of 2988 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 115 PID 440 wrote to memory of 2988 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 115 PID 440 wrote to memory of 2988 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 115 PID 440 wrote to memory of 3204 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 112 PID 440 wrote to memory of 3204 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 112 PID 440 wrote to memory of 3204 440 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 112 PID 1460 wrote to memory of 3336 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 117 PID 1460 wrote to memory of 3336 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 117 PID 1460 wrote to memory of 3336 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 117 PID 1460 wrote to memory of 5088 1460 e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe 119 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe"C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\yQEcQQQQ\YgosIYMk.exe"C:\Users\Admin\yQEcQQQQ\YgosIYMk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3368
-
-
C:\ProgramData\PYIEsEAY\CessUQEY.exe"C:\ProgramData\PYIEsEAY\CessUQEY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2992
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"2⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e43⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"4⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e45⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"6⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e47⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"8⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e49⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"10⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e411⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"12⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e413⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"14⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e415⤵
- Suspicious behavior: EnumeratesProcesses
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"16⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e417⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"18⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e419⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"20⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e421⤵
- Suspicious behavior: EnumeratesProcesses
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"22⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e423⤵
- Suspicious behavior: EnumeratesProcesses
PID:176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"24⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e425⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"26⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e427⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"28⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e429⤵
- Suspicious behavior: EnumeratesProcesses
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"30⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e431⤵
- Suspicious behavior: EnumeratesProcesses
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"32⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e433⤵PID:1228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"34⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e435⤵PID:3748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"36⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e437⤵PID:3176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"38⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e439⤵PID:3964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"40⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e441⤵PID:5116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"42⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e443⤵PID:4356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"44⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e445⤵PID:116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"46⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e447⤵PID:680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"48⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e449⤵PID:4324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"50⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e451⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"52⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e453⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"54⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e455⤵PID:4140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"56⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e457⤵PID:2428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"58⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e459⤵PID:4624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"60⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e461⤵PID:3712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"62⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e463⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"64⤵PID:4204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e465⤵PID:2820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"66⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e467⤵PID:3404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"68⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e469⤵PID:3860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"70⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e471⤵PID:4596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"72⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e473⤵PID:3184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"74⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e475⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"76⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e477⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"78⤵PID:5088
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:4204
-
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e479⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"80⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e481⤵PID:1060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"82⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e483⤵
- Modifies visibility of file extensions in Explorer
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"84⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e485⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"86⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e487⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"88⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e489⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"90⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e491⤵PID:2708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"92⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e493⤵PID:5072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"94⤵PID:2404
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e495⤵PID:3744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"96⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e497⤵PID:3824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"98⤵
- Modifies visibility of file extensions in Explorer
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e499⤵PID:3132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"100⤵PID:4576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4101⤵PID:4120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"102⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4103⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"104⤵PID:1932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
- Modifies visibility of file extensions in Explorer
PID:3372
-
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4105⤵PID:4868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"106⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4107⤵PID:2392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"108⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4109⤵PID:3012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"110⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4111⤵PID:1592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"112⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4113⤵PID:1160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"114⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4115⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"116⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4117⤵PID:988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"118⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4119⤵PID:3976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"120⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4.exeC:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4121⤵
- Modifies visibility of file extensions in Explorer
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e9043292ac23c1f176da9b907f4c9c29df7a08e16734b0633b056d8a06c854e4"122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-