Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe
Resource
win10v2004-20221111-en
General
-
Target
3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe
-
Size
506KB
-
MD5
22ea7d2e93ff8eb95fb461c9bd495e30
-
SHA1
ea76ca9758f7eddb0f4654e078f7613403d02bc9
-
SHA256
3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741
-
SHA512
a2e39f9ec4030893ed2470365516ffe56db7560a6da0a147d72d134a1e33d898b4c12bae023c2d7860dbc424b318cca3b83790b5fccc590a7a67caa9fdce62e0
-
SSDEEP
12288:/enUy798MPK9C/AAANyd3OqIPx9dzztgm8rjOmSYZIQIb:2nUy798MEC/+qIP/dkjDZzIb
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 3 IoCs
pid Process 4592 wqwkQYwU.exe 220 VkUMAUMw.exe 3856 RSscEgwg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wqwkQYwU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KYcYYcww.exe = "C:\\ProgramData\\DasMMQUI\\KYcYYcww.exe" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wqwkQYwU.exe = "C:\\Users\\Admin\\boIcsYwI\\wqwkQYwU.exe" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VkUMAUMw.exe = "C:\\ProgramData\\ZcYcMEEo\\VkUMAUMw.exe" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wqwkQYwU.exe = "C:\\Users\\Admin\\boIcsYwI\\wqwkQYwU.exe" wqwkQYwU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VkUMAUMw.exe = "C:\\ProgramData\\ZcYcMEEo\\VkUMAUMw.exe" VkUMAUMw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VkUMAUMw.exe = "C:\\ProgramData\\ZcYcMEEo\\VkUMAUMw.exe" RSscEgwg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FYYQgIYw.exe = "C:\\Users\\Admin\\USAkUkgA\\FYYQgIYw.exe" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\boIcsYwI RSscEgwg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\boIcsYwI\wqwkQYwU RSscEgwg.exe File created C:\Windows\SysWOW64\shell32.dll.exe wqwkQYwU.exe File opened for modification C:\Windows\SysWOW64\sheSendLimit.jpg wqwkQYwU.exe File opened for modification C:\Windows\SysWOW64\sheUpdateFormat.xls wqwkQYwU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 3912 8 WerFault.exe 288 4816 3244 WerFault.exe 291 2008 4476 WerFault.exe 289 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 4040 reg.exe 2312 reg.exe 1156 reg.exe 4348 reg.exe 3156 reg.exe 5048 reg.exe 2344 reg.exe 2700 reg.exe 3204 reg.exe 1044 reg.exe 1160 reg.exe 3340 reg.exe 1856 reg.exe 904 reg.exe 4960 reg.exe 2848 reg.exe 1700 reg.exe 2044 reg.exe 2940 reg.exe 3156 reg.exe 2256 reg.exe 3608 reg.exe 3116 reg.exe 4948 reg.exe 1404 reg.exe 3880 reg.exe 4172 reg.exe 3528 reg.exe 3012 reg.exe 316 reg.exe 2688 reg.exe 3608 reg.exe 3576 reg.exe 2812 reg.exe 2700 reg.exe 4340 reg.exe 4632 reg.exe 4680 reg.exe 1240 reg.exe 2168 reg.exe 4368 reg.exe 880 reg.exe 4912 reg.exe 4736 reg.exe 1592 reg.exe 3700 reg.exe 1528 reg.exe 2488 reg.exe 1484 reg.exe 8 reg.exe 4224 reg.exe 1176 reg.exe 1796 reg.exe 1996 reg.exe 1412 reg.exe 4568 reg.exe 2136 reg.exe 1148 reg.exe 4276 reg.exe 3608 reg.exe 1820 reg.exe 4336 reg.exe 3492 reg.exe 1752 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3488 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3488 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3488 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3488 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3768 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3768 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3768 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3768 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 2912 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 2912 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 2912 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 2912 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4368 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4368 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4368 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4368 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1824 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1824 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1824 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1824 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4008 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4008 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4008 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4008 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4332 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4332 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4332 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4332 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3544 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3544 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3544 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3544 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1528 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1528 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1528 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 1528 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 3380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4808 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4808 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4808 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 4808 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4592 wqwkQYwU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe 4592 wqwkQYwU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 4592 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 84 PID 4380 wrote to memory of 4592 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 84 PID 4380 wrote to memory of 4592 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 84 PID 4380 wrote to memory of 220 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 85 PID 4380 wrote to memory of 220 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 85 PID 4380 wrote to memory of 220 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 85 PID 4380 wrote to memory of 4256 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 87 PID 4380 wrote to memory of 4256 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 87 PID 4380 wrote to memory of 4256 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 87 PID 4380 wrote to memory of 1888 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 89 PID 4380 wrote to memory of 1888 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 89 PID 4380 wrote to memory of 1888 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 89 PID 4380 wrote to memory of 4428 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 94 PID 4380 wrote to memory of 4428 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 94 PID 4380 wrote to memory of 4428 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 94 PID 4380 wrote to memory of 2728 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 93 PID 4380 wrote to memory of 2728 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 93 PID 4380 wrote to memory of 2728 4380 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 93 PID 4256 wrote to memory of 1136 4256 cmd.exe 91 PID 4256 wrote to memory of 1136 4256 cmd.exe 91 PID 4256 wrote to memory of 1136 4256 cmd.exe 91 PID 1136 wrote to memory of 4680 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 96 PID 1136 wrote to memory of 4680 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 96 PID 1136 wrote to memory of 4680 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 96 PID 1136 wrote to memory of 3076 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 98 PID 1136 wrote to memory of 3076 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 98 PID 1136 wrote to memory of 3076 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 98 PID 1136 wrote to memory of 4568 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 PID 1136 wrote to memory of 4568 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 PID 1136 wrote to memory of 4568 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 100 PID 1136 wrote to memory of 4384 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 102 PID 1136 wrote to memory of 4384 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 102 PID 1136 wrote to memory of 4384 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 102 PID 1136 wrote to memory of 2036 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 103 PID 1136 wrote to memory of 2036 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 103 PID 1136 wrote to memory of 2036 1136 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 103 PID 4680 wrote to memory of 4552 4680 cmd.exe 106 PID 4680 wrote to memory of 4552 4680 cmd.exe 106 PID 4680 wrote to memory of 4552 4680 cmd.exe 106 PID 4552 wrote to memory of 4284 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 107 PID 4552 wrote to memory of 4284 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 107 PID 4552 wrote to memory of 4284 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 107 PID 4284 wrote to memory of 540 4284 cmd.exe 110 PID 4284 wrote to memory of 540 4284 cmd.exe 110 PID 4284 wrote to memory of 540 4284 cmd.exe 110 PID 4552 wrote to memory of 3456 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 109 PID 4552 wrote to memory of 3456 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 109 PID 4552 wrote to memory of 3456 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 109 PID 4552 wrote to memory of 4368 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 111 PID 4552 wrote to memory of 4368 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 111 PID 4552 wrote to memory of 4368 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 111 PID 4552 wrote to memory of 1404 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 112 PID 4552 wrote to memory of 1404 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 112 PID 4552 wrote to memory of 1404 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 112 PID 4552 wrote to memory of 3732 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 113 PID 4552 wrote to memory of 3732 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 113 PID 4552 wrote to memory of 3732 4552 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 113 PID 540 wrote to memory of 4884 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 117 PID 540 wrote to memory of 4884 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 117 PID 540 wrote to memory of 4884 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 117 PID 540 wrote to memory of 2688 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 120 PID 540 wrote to memory of 2688 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 120 PID 540 wrote to memory of 2688 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 120 PID 540 wrote to memory of 1976 540 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe 123 -
System policy modification 1 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe"C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\boIcsYwI\wqwkQYwU.exe"C:\Users\Admin\boIcsYwI\wqwkQYwU.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4592
-
-
C:\ProgramData\ZcYcMEEo\VkUMAUMw.exe"C:\ProgramData\ZcYcMEEo\VkUMAUMw.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:220
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"2⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec57413⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"4⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec57415⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"6⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec57417⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"8⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec57419⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"10⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574111⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"12⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574113⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"14⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574115⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"16⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574117⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"18⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574119⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"20⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574121⤵
- Suspicious behavior: EnumeratesProcesses
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"22⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574123⤵
- Suspicious behavior: EnumeratesProcesses
PID:100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"24⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574125⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"26⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574127⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"28⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574129⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"30⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574131⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"32⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574133⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"34⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574135⤵
- Adds Run key to start application
PID:4584 -
C:\Users\Admin\USAkUkgA\FYYQgIYw.exe"C:\Users\Admin\USAkUkgA\FYYQgIYw.exe"36⤵PID:8
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 28437⤵
- Program crash
PID:3912
-
-
-
C:\ProgramData\DasMMQUI\KYcYYcww.exe"C:\ProgramData\DasMMQUI\KYcYYcww.exe"36⤵PID:4476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 39237⤵
- Program crash
PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"36⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574137⤵PID:4472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"38⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574139⤵PID:2452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"40⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574141⤵PID:1404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"42⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574143⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"44⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574145⤵PID:4408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"46⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574147⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"48⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574149⤵PID:644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"50⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574151⤵PID:884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"52⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574153⤵PID:2600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"54⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574155⤵PID:1940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"56⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574157⤵PID:1616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"58⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574159⤵PID:1328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"60⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574161⤵PID:1284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"62⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574163⤵PID:1528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"64⤵PID:3652
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574165⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"66⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574167⤵PID:1320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"68⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574169⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"70⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574171⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"72⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574173⤵PID:1856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"74⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574175⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"76⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574177⤵PID:1216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"78⤵PID:884
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574179⤵PID:1900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"80⤵PID:4032
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
- UAC bypass
PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574181⤵PID:4296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"82⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574183⤵PID:2632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"84⤵PID:2084
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵PID:920
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574185⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"86⤵PID:1320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3240
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574187⤵PID:4960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"88⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574189⤵PID:2704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"90⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574191⤵PID:4704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"92⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574193⤵PID:2320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"94⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574195⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"96⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574197⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"98⤵PID:2452
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec574199⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"100⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741101⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"102⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741103⤵PID:1060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"104⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741105⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"106⤵PID:944
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741107⤵PID:1940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"108⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741109⤵PID:1972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"110⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741111⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"112⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741113⤵PID:4140
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"114⤵PID:3204
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:100
-
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741115⤵PID:2136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"116⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741117⤵PID:3940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"118⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741119⤵PID:2028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"120⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741.exeC:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741121⤵PID:1992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3768016703a237772237ca984d973ee46bb9a88719bc3487a71e0c29acec5741"122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-