8efd0ddff72ea81c08765428196b377f9a392340c71a1e4fd27af97ae8fa4cce

Analysis

max time kernel
160s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

094eb7232a831ad5e1988418ca04aaf2.exe
Size

92KB
MD5

094eb7232a831ad5e1988418ca04aaf2
SHA1

9568364d6092edf8f68ec7cf8e05c26a4bba1199
SHA256

8efd0ddff72ea81c08765428196b377f9a392340c71a1e4fd27af97ae8fa4cce
SHA512

9399fd176338c8310acb1c0510a37480b29176879ac4f44a1090be4c20c7fe7a2f81c5827164217002a4c072a70859bae24e42a0cc4cd0320c55adaebd0d0a3f
SSDEEP

1536:DKjvoJWqo6gW5p3xIdsxK1ZrZPto0RROrPoulv1rIUIo3WVdq2+dwDHxm3:DKjvojOW5XIXnPo0RErgA3/3WVd1AkR

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 64 IoCs

evasion

pid	Process
924	taskkill.exe
2376	taskkill.exe
2900	taskkill.exe
3060	taskkill.exe
1716	taskkill.exe
1760	taskkill.exe
1280	taskkill.exe
1756	taskkill.exe
2664	taskkill.exe
1304	taskkill.exe
1444	taskkill.exe
2056	taskkill.exe
512	taskkill.exe
1144	taskkill.exe
2284	taskkill.exe
3012	taskkill.exe
2704	taskkill.exe
2840	taskkill.exe
1556	taskkill.exe
1124	taskkill.exe
3016	taskkill.exe
1768	taskkill.exe
2592	taskkill.exe
2776	taskkill.exe
3064	taskkill.exe
2612	taskkill.exe
2864	taskkill.exe
2332	taskkill.exe
808	taskkill.exe
2804	taskkill.exe
2760	taskkill.exe
3036	taskkill.exe
2196	taskkill.exe
1956	taskkill.exe
916	taskkill.exe
2496	taskkill.exe
1120	taskkill.exe
2360	taskkill.exe
2464	taskkill.exe
1412	taskkill.exe
2372	taskkill.exe
2488	taskkill.exe
2404	taskkill.exe
556	taskkill.exe
3048	taskkill.exe
2256	taskkill.exe
2264	taskkill.exe
2552	taskkill.exe
2604	taskkill.exe
2144	taskkill.exe
2872	taskkill.exe
1592	taskkill.exe
1480	taskkill.exe
1764	taskkill.exe
2220	taskkill.exe
2524	taskkill.exe
1492	taskkill.exe
2956	taskkill.exe
2784	taskkill.exe
2472	taskkill.exe
2632	taskkill.exe
2136	taskkill.exe
1020	taskkill.exe
1088	taskkill.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveActive = "0"	094eb7232a831ad5e1988418ca04aaf2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	1124	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	276	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	972	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	1872	taskkill.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	812	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1428	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2020	094eb7232a831ad5e1988418ca04aaf2.exe
2020	094eb7232a831ad5e1988418ca04aaf2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1960	2020	094eb7232a831ad5e1988418ca04aaf2.exe	26
PID 2020 wrote to memory of 1960	2020	094eb7232a831ad5e1988418ca04aaf2.exe	26
PID 2020 wrote to memory of 1960	2020	094eb7232a831ad5e1988418ca04aaf2.exe	26
PID 2020 wrote to memory of 1960	2020	094eb7232a831ad5e1988418ca04aaf2.exe	26
PID 2020 wrote to memory of 1480	2020	094eb7232a831ad5e1988418ca04aaf2.exe	28
PID 2020 wrote to memory of 1480	2020	094eb7232a831ad5e1988418ca04aaf2.exe	28
PID 2020 wrote to memory of 1480	2020	094eb7232a831ad5e1988418ca04aaf2.exe	28
PID 2020 wrote to memory of 1480	2020	094eb7232a831ad5e1988418ca04aaf2.exe	28
PID 2020 wrote to memory of 1196	2020	094eb7232a831ad5e1988418ca04aaf2.exe	30
PID 2020 wrote to memory of 1196	2020	094eb7232a831ad5e1988418ca04aaf2.exe	30
PID 2020 wrote to memory of 1196	2020	094eb7232a831ad5e1988418ca04aaf2.exe	30
PID 2020 wrote to memory of 1196	2020	094eb7232a831ad5e1988418ca04aaf2.exe	30
PID 2020 wrote to memory of 1124	2020	094eb7232a831ad5e1988418ca04aaf2.exe	32
PID 2020 wrote to memory of 1124	2020	094eb7232a831ad5e1988418ca04aaf2.exe	32
PID 2020 wrote to memory of 1124	2020	094eb7232a831ad5e1988418ca04aaf2.exe	32
PID 2020 wrote to memory of 1124	2020	094eb7232a831ad5e1988418ca04aaf2.exe	32
PID 2020 wrote to memory of 944	2020	094eb7232a831ad5e1988418ca04aaf2.exe	34
PID 2020 wrote to memory of 944	2020	094eb7232a831ad5e1988418ca04aaf2.exe	34
PID 2020 wrote to memory of 944	2020	094eb7232a831ad5e1988418ca04aaf2.exe	34
PID 2020 wrote to memory of 944	2020	094eb7232a831ad5e1988418ca04aaf2.exe	34
PID 2020 wrote to memory of 632	2020	094eb7232a831ad5e1988418ca04aaf2.exe	36
PID 2020 wrote to memory of 632	2020	094eb7232a831ad5e1988418ca04aaf2.exe	36
PID 2020 wrote to memory of 632	2020	094eb7232a831ad5e1988418ca04aaf2.exe	36
PID 2020 wrote to memory of 632	2020	094eb7232a831ad5e1988418ca04aaf2.exe	36
PID 2020 wrote to memory of 808	2020	094eb7232a831ad5e1988418ca04aaf2.exe	38
PID 2020 wrote to memory of 808	2020	094eb7232a831ad5e1988418ca04aaf2.exe	38
PID 2020 wrote to memory of 808	2020	094eb7232a831ad5e1988418ca04aaf2.exe	38
PID 2020 wrote to memory of 808	2020	094eb7232a831ad5e1988418ca04aaf2.exe	38
PID 2020 wrote to memory of 1280	2020	094eb7232a831ad5e1988418ca04aaf2.exe	40
PID 2020 wrote to memory of 1280	2020	094eb7232a831ad5e1988418ca04aaf2.exe	40
PID 2020 wrote to memory of 1280	2020	094eb7232a831ad5e1988418ca04aaf2.exe	40
PID 2020 wrote to memory of 1280	2020	094eb7232a831ad5e1988418ca04aaf2.exe	40
PID 2020 wrote to memory of 1764	2020	094eb7232a831ad5e1988418ca04aaf2.exe	42
PID 2020 wrote to memory of 1764	2020	094eb7232a831ad5e1988418ca04aaf2.exe	42
PID 2020 wrote to memory of 1764	2020	094eb7232a831ad5e1988418ca04aaf2.exe	42
PID 2020 wrote to memory of 1764	2020	094eb7232a831ad5e1988418ca04aaf2.exe	42
PID 2020 wrote to memory of 1028	2020	094eb7232a831ad5e1988418ca04aaf2.exe	44
PID 2020 wrote to memory of 1028	2020	094eb7232a831ad5e1988418ca04aaf2.exe	44
PID 2020 wrote to memory of 1028	2020	094eb7232a831ad5e1988418ca04aaf2.exe	44
PID 2020 wrote to memory of 1028	2020	094eb7232a831ad5e1988418ca04aaf2.exe	44
PID 2020 wrote to memory of 1928	2020	094eb7232a831ad5e1988418ca04aaf2.exe	46
PID 2020 wrote to memory of 1928	2020	094eb7232a831ad5e1988418ca04aaf2.exe	46
PID 2020 wrote to memory of 1928	2020	094eb7232a831ad5e1988418ca04aaf2.exe	46
PID 2020 wrote to memory of 1928	2020	094eb7232a831ad5e1988418ca04aaf2.exe	46
PID 2020 wrote to memory of 1756	2020	094eb7232a831ad5e1988418ca04aaf2.exe	48
PID 2020 wrote to memory of 1756	2020	094eb7232a831ad5e1988418ca04aaf2.exe	48
PID 2020 wrote to memory of 1756	2020	094eb7232a831ad5e1988418ca04aaf2.exe	48
PID 2020 wrote to memory of 1756	2020	094eb7232a831ad5e1988418ca04aaf2.exe	48
PID 2020 wrote to memory of 276	2020	094eb7232a831ad5e1988418ca04aaf2.exe	50
PID 2020 wrote to memory of 276	2020	094eb7232a831ad5e1988418ca04aaf2.exe	50
PID 2020 wrote to memory of 276	2020	094eb7232a831ad5e1988418ca04aaf2.exe	50
PID 2020 wrote to memory of 276	2020	094eb7232a831ad5e1988418ca04aaf2.exe	50
PID 2020 wrote to memory of 1552	2020	094eb7232a831ad5e1988418ca04aaf2.exe	52
PID 2020 wrote to memory of 1552	2020	094eb7232a831ad5e1988418ca04aaf2.exe	52
PID 2020 wrote to memory of 1552	2020	094eb7232a831ad5e1988418ca04aaf2.exe	52
PID 2020 wrote to memory of 1552	2020	094eb7232a831ad5e1988418ca04aaf2.exe	52
PID 2020 wrote to memory of 2240	2020	094eb7232a831ad5e1988418ca04aaf2.exe	55
PID 2020 wrote to memory of 2240	2020	094eb7232a831ad5e1988418ca04aaf2.exe	55
PID 2020 wrote to memory of 2240	2020	094eb7232a831ad5e1988418ca04aaf2.exe	55
PID 2020 wrote to memory of 2240	2020	094eb7232a831ad5e1988418ca04aaf2.exe	55
PID 2020 wrote to memory of 2296	2020	094eb7232a831ad5e1988418ca04aaf2.exe	57
PID 2020 wrote to memory of 2296	2020	094eb7232a831ad5e1988418ca04aaf2.exe	57
PID 2020 wrote to memory of 2296	2020	094eb7232a831ad5e1988418ca04aaf2.exe	57
PID 2020 wrote to memory of 2296	2020	094eb7232a831ad5e1988418ca04aaf2.exe	57

C:\Users\Admin\AppData\Local\Temp\094eb7232a831ad5e1988418ca04aaf2.exe
"C:\Users\Admin\AppData\Local\Temp\094eb7232a831ad5e1988418ca04aaf2.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:276
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2076
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:556
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2264
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2360
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2428
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2524
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2564
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2688
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2736
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2840
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2052
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2948
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:512
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2996
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3060
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1300
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:728
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1304
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1492
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2432
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2464
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2552
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2556
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2604
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2812
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2804
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2852
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1144
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1412
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2228
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1504
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2332
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2284
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1592
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2496
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1116
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2136
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1716
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2880
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2068
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3012
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3036
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1020
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1088
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2372
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2452
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2592
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2168
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2172
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2704
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2908
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2904
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2056
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1640
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1744
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1556
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1980
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2472
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2548
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2668
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2144
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1600
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:1792
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x00000000000F0000-0x00000000000FD000-memory.dmp

Filesize
52KB

Download
memory/2020-56-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/2020-57-0x00000000008E0000-0x000000000090F000-memory.dmp

Filesize
188KB

Download
memory/2020-70-0x00000000008E0000-0x000000000090F000-memory.dmp

Filesize
188KB

Download