Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
c24601317ac7790b94552d94d91e93b8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c24601317ac7790b94552d94d91e93b8.exe
Resource
win10v2004-20230220-en
General
-
Target
c24601317ac7790b94552d94d91e93b8.exe
-
Size
198KB
-
MD5
c24601317ac7790b94552d94d91e93b8
-
SHA1
5360294d421ce78a701fe14f2ac40376a6900bd4
-
SHA256
e8c370012027c85f0ef910fa25385d8e8652df038cb9ac71294fc744334b215e
-
SHA512
5c525b6838058cad8eedc78fb2dd277c76561f286ffa7a8cd36214f071cb4c3793f7d59190a1c7b83c996afb5344dc480d62de4541d47cf8399aaeea85966ca0
-
SSDEEP
3072:x81f/IOU5/r2RF9gb4Lp3p4dil/c0wbXODCJ8wU5MTnqIH+ejcNC:Kh/LA09yspZKuE7XOAHBTnqecN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe -
Executes dropped EXE 2 IoCs
pid Process 1052 YiUYkwwA.exe 1716 nagUQscE.exe -
Loads dropped DLL 8 IoCs
pid Process 1356 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1052 YiUYkwwA.exe 1052 YiUYkwwA.exe 1052 YiUYkwwA.exe 1052 YiUYkwwA.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\YiUYkwwA.exe = "C:\\Users\\Admin\\xcUQAQkQ\\YiUYkwwA.exe" YiUYkwwA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nagUQscE.exe = "C:\\ProgramData\\bOsIMckc\\nagUQscE.exe" nagUQscE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\YiUYkwwA.exe = "C:\\Users\\Admin\\xcUQAQkQ\\YiUYkwwA.exe" c24601317ac7790b94552d94d91e93b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nagUQscE.exe = "C:\\ProgramData\\bOsIMckc\\nagUQscE.exe" c24601317ac7790b94552d94d91e93b8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c24601317ac7790b94552d94d91e93b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c24601317ac7790b94552d94d91e93b8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 296 reg.exe 876 reg.exe 1984 reg.exe 1784 reg.exe 1620 reg.exe 428 reg.exe 2036 reg.exe 1712 reg.exe 1568 reg.exe 2004 reg.exe 1792 reg.exe 1864 reg.exe 2032 reg.exe 1728 reg.exe 848 reg.exe 1480 reg.exe 876 reg.exe 960 reg.exe 272 reg.exe 936 reg.exe 620 reg.exe 1160 reg.exe 1380 reg.exe 1792 reg.exe 1608 reg.exe 1644 reg.exe 1640 reg.exe 924 reg.exe 1484 reg.exe 932 reg.exe 1660 reg.exe 1644 reg.exe 752 reg.exe 824 reg.exe 904 reg.exe 924 reg.exe 2000 reg.exe 1480 reg.exe 1620 reg.exe 1316 reg.exe 1992 reg.exe 880 reg.exe 612 reg.exe 292 reg.exe 1712 reg.exe 2028 reg.exe 1160 reg.exe 1480 reg.exe 1728 reg.exe 1776 reg.exe 1640 reg.exe 916 reg.exe 1332 reg.exe 1568 reg.exe 1380 reg.exe 1784 reg.exe 1216 reg.exe 904 reg.exe 936 reg.exe 300 reg.exe 1388 reg.exe 428 reg.exe 1356 reg.exe 880 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1492 c24601317ac7790b94552d94d91e93b8.exe 1492 c24601317ac7790b94552d94d91e93b8.exe 880 c24601317ac7790b94552d94d91e93b8.exe 880 c24601317ac7790b94552d94d91e93b8.exe 1604 c24601317ac7790b94552d94d91e93b8.exe 1604 c24601317ac7790b94552d94d91e93b8.exe 808 c24601317ac7790b94552d94d91e93b8.exe 808 c24601317ac7790b94552d94d91e93b8.exe 1760 c24601317ac7790b94552d94d91e93b8.exe 1760 c24601317ac7790b94552d94d91e93b8.exe 1332 c24601317ac7790b94552d94d91e93b8.exe 1332 c24601317ac7790b94552d94d91e93b8.exe 848 c24601317ac7790b94552d94d91e93b8.exe 848 c24601317ac7790b94552d94d91e93b8.exe 936 c24601317ac7790b94552d94d91e93b8.exe 936 c24601317ac7790b94552d94d91e93b8.exe 1332 c24601317ac7790b94552d94d91e93b8.exe 1332 c24601317ac7790b94552d94d91e93b8.exe 2028 c24601317ac7790b94552d94d91e93b8.exe 2028 c24601317ac7790b94552d94d91e93b8.exe 1668 c24601317ac7790b94552d94d91e93b8.exe 1668 c24601317ac7790b94552d94d91e93b8.exe 2044 c24601317ac7790b94552d94d91e93b8.exe 2044 c24601317ac7790b94552d94d91e93b8.exe 1252 c24601317ac7790b94552d94d91e93b8.exe 1252 c24601317ac7790b94552d94d91e93b8.exe 308 c24601317ac7790b94552d94d91e93b8.exe 308 c24601317ac7790b94552d94d91e93b8.exe 1140 c24601317ac7790b94552d94d91e93b8.exe 1140 c24601317ac7790b94552d94d91e93b8.exe 1636 c24601317ac7790b94552d94d91e93b8.exe 1636 c24601317ac7790b94552d94d91e93b8.exe 572 c24601317ac7790b94552d94d91e93b8.exe 572 c24601317ac7790b94552d94d91e93b8.exe 596 c24601317ac7790b94552d94d91e93b8.exe 596 c24601317ac7790b94552d94d91e93b8.exe 1536 c24601317ac7790b94552d94d91e93b8.exe 1536 c24601317ac7790b94552d94d91e93b8.exe 1160 c24601317ac7790b94552d94d91e93b8.exe 1160 c24601317ac7790b94552d94d91e93b8.exe 1576 c24601317ac7790b94552d94d91e93b8.exe 1576 c24601317ac7790b94552d94d91e93b8.exe 1880 c24601317ac7790b94552d94d91e93b8.exe 1880 c24601317ac7790b94552d94d91e93b8.exe 1776 c24601317ac7790b94552d94d91e93b8.exe 1776 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1356 c24601317ac7790b94552d94d91e93b8.exe 1276 c24601317ac7790b94552d94d91e93b8.exe 1276 c24601317ac7790b94552d94d91e93b8.exe 1496 c24601317ac7790b94552d94d91e93b8.exe 1496 c24601317ac7790b94552d94d91e93b8.exe 268 c24601317ac7790b94552d94d91e93b8.exe 268 c24601317ac7790b94552d94d91e93b8.exe 1256 c24601317ac7790b94552d94d91e93b8.exe 1256 c24601317ac7790b94552d94d91e93b8.exe 1580 c24601317ac7790b94552d94d91e93b8.exe 1580 c24601317ac7790b94552d94d91e93b8.exe 1636 c24601317ac7790b94552d94d91e93b8.exe 1636 c24601317ac7790b94552d94d91e93b8.exe 1392 c24601317ac7790b94552d94d91e93b8.exe 1392 c24601317ac7790b94552d94d91e93b8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1356 wrote to memory of 1052 1356 c24601317ac7790b94552d94d91e93b8.exe 28 PID 1356 wrote to memory of 1052 1356 c24601317ac7790b94552d94d91e93b8.exe 28 PID 1356 wrote to memory of 1052 1356 c24601317ac7790b94552d94d91e93b8.exe 28 PID 1356 wrote to memory of 1052 1356 c24601317ac7790b94552d94d91e93b8.exe 28 PID 1356 wrote to memory of 1716 1356 c24601317ac7790b94552d94d91e93b8.exe 29 PID 1356 wrote to memory of 1716 1356 c24601317ac7790b94552d94d91e93b8.exe 29 PID 1356 wrote to memory of 1716 1356 c24601317ac7790b94552d94d91e93b8.exe 29 PID 1356 wrote to memory of 1716 1356 c24601317ac7790b94552d94d91e93b8.exe 29 PID 1356 wrote to memory of 552 1356 c24601317ac7790b94552d94d91e93b8.exe 30 PID 1356 wrote to memory of 552 1356 c24601317ac7790b94552d94d91e93b8.exe 30 PID 1356 wrote to memory of 552 1356 c24601317ac7790b94552d94d91e93b8.exe 30 PID 1356 wrote to memory of 552 1356 c24601317ac7790b94552d94d91e93b8.exe 30 PID 552 wrote to memory of 1492 552 cmd.exe 32 PID 552 wrote to memory of 1492 552 cmd.exe 32 PID 552 wrote to memory of 1492 552 cmd.exe 32 PID 552 wrote to memory of 1492 552 cmd.exe 32 PID 1492 wrote to memory of 1860 1492 c24601317ac7790b94552d94d91e93b8.exe 34 PID 1492 wrote to memory of 1860 1492 c24601317ac7790b94552d94d91e93b8.exe 34 PID 1492 wrote to memory of 1860 1492 c24601317ac7790b94552d94d91e93b8.exe 34 PID 1492 wrote to memory of 1860 1492 c24601317ac7790b94552d94d91e93b8.exe 34 PID 1356 wrote to memory of 688 1356 c24601317ac7790b94552d94d91e93b8.exe 33 PID 1356 wrote to memory of 688 1356 c24601317ac7790b94552d94d91e93b8.exe 33 PID 1356 wrote to memory of 688 1356 c24601317ac7790b94552d94d91e93b8.exe 33 PID 1356 wrote to memory of 688 1356 c24601317ac7790b94552d94d91e93b8.exe 33 PID 1356 wrote to memory of 1576 1356 c24601317ac7790b94552d94d91e93b8.exe 36 PID 1356 wrote to memory of 1576 1356 c24601317ac7790b94552d94d91e93b8.exe 36 PID 1356 wrote to memory of 1576 1356 c24601317ac7790b94552d94d91e93b8.exe 36 PID 1356 wrote to memory of 1576 1356 c24601317ac7790b94552d94d91e93b8.exe 36 PID 1356 wrote to memory of 1208 1356 c24601317ac7790b94552d94d91e93b8.exe 37 PID 1356 wrote to memory of 1208 1356 c24601317ac7790b94552d94d91e93b8.exe 37 PID 1356 wrote to memory of 1208 1356 c24601317ac7790b94552d94d91e93b8.exe 37 PID 1356 wrote to memory of 1208 1356 c24601317ac7790b94552d94d91e93b8.exe 37 PID 1356 wrote to memory of 1160 1356 c24601317ac7790b94552d94d91e93b8.exe 39 PID 1356 wrote to memory of 1160 1356 c24601317ac7790b94552d94d91e93b8.exe 39 PID 1356 wrote to memory of 1160 1356 c24601317ac7790b94552d94d91e93b8.exe 39 PID 1356 wrote to memory of 1160 1356 c24601317ac7790b94552d94d91e93b8.exe 39 PID 1860 wrote to memory of 880 1860 cmd.exe 40 PID 1860 wrote to memory of 880 1860 cmd.exe 40 PID 1860 wrote to memory of 880 1860 cmd.exe 40 PID 1860 wrote to memory of 880 1860 cmd.exe 40 PID 1160 wrote to memory of 1200 1160 cmd.exe 44 PID 1160 wrote to memory of 1200 1160 cmd.exe 44 PID 1160 wrote to memory of 1200 1160 cmd.exe 44 PID 1160 wrote to memory of 1200 1160 cmd.exe 44 PID 1492 wrote to memory of 1728 1492 c24601317ac7790b94552d94d91e93b8.exe 45 PID 1492 wrote to memory of 1728 1492 c24601317ac7790b94552d94d91e93b8.exe 45 PID 1492 wrote to memory of 1728 1492 c24601317ac7790b94552d94d91e93b8.exe 45 PID 1492 wrote to memory of 1728 1492 c24601317ac7790b94552d94d91e93b8.exe 45 PID 1492 wrote to memory of 2032 1492 c24601317ac7790b94552d94d91e93b8.exe 47 PID 1492 wrote to memory of 2032 1492 c24601317ac7790b94552d94d91e93b8.exe 47 PID 1492 wrote to memory of 2032 1492 c24601317ac7790b94552d94d91e93b8.exe 47 PID 1492 wrote to memory of 2032 1492 c24601317ac7790b94552d94d91e93b8.exe 47 PID 1492 wrote to memory of 1656 1492 c24601317ac7790b94552d94d91e93b8.exe 48 PID 1492 wrote to memory of 1656 1492 c24601317ac7790b94552d94d91e93b8.exe 48 PID 1492 wrote to memory of 1656 1492 c24601317ac7790b94552d94d91e93b8.exe 48 PID 1492 wrote to memory of 1656 1492 c24601317ac7790b94552d94d91e93b8.exe 48 PID 1492 wrote to memory of 1760 1492 c24601317ac7790b94552d94d91e93b8.exe 51 PID 1492 wrote to memory of 1760 1492 c24601317ac7790b94552d94d91e93b8.exe 51 PID 1492 wrote to memory of 1760 1492 c24601317ac7790b94552d94d91e93b8.exe 51 PID 1492 wrote to memory of 1760 1492 c24601317ac7790b94552d94d91e93b8.exe 51 PID 1760 wrote to memory of 968 1760 cmd.exe 53 PID 1760 wrote to memory of 968 1760 cmd.exe 53 PID 1760 wrote to memory of 968 1760 cmd.exe 53 PID 1760 wrote to memory of 968 1760 cmd.exe 53 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c24601317ac7790b94552d94d91e93b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c24601317ac7790b94552d94d91e93b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c24601317ac7790b94552d94d91e93b8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exe"C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\xcUQAQkQ\YiUYkwwA.exe"C:\Users\Admin\xcUQAQkQ\YiUYkwwA.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1052
-
-
C:\ProgramData\bOsIMckc\nagUQscE.exe"C:\ProgramData\bOsIMckc\nagUQscE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1716
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"4⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b85⤵
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"6⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b87⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"8⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b89⤵
- Suspicious behavior: EnumeratesProcesses
PID:808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"10⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b811⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"12⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b813⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"14⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b815⤵
- Suspicious behavior: EnumeratesProcesses
PID:848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"16⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b817⤵
- Suspicious behavior: EnumeratesProcesses
PID:936 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"18⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b819⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"20⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b821⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"22⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b823⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"24⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b825⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"26⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b827⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"28⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b829⤵
- Suspicious behavior: EnumeratesProcesses
PID:308 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"30⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b831⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"32⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b833⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"34⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b835⤵
- Suspicious behavior: EnumeratesProcesses
PID:572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"36⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b837⤵
- Suspicious behavior: EnumeratesProcesses
PID:596 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"38⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b839⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"40⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b841⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"42⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b843⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"44⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b845⤵
- Suspicious behavior: EnumeratesProcesses
PID:1880 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"46⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b847⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"48⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b849⤵
- Suspicious behavior: EnumeratesProcesses
PID:1356 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"50⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b851⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"52⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b853⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"54⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b855⤵
- Suspicious behavior: EnumeratesProcesses
PID:268 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"56⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b857⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"58⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b859⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"60⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b861⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"62⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b863⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"64⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b865⤵PID:1388
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"66⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b867⤵PID:1428
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"68⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b869⤵PID:572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"70⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b871⤵PID:296
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"72⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b873⤵PID:1852
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"74⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b875⤵PID:1620
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"76⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b877⤵PID:572
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"78⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b879⤵PID:1800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"80⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b881⤵PID:1480
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"82⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b883⤵PID:924
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"84⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b885⤵PID:1216
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"86⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b887⤵PID:1080
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"88⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b889⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:968 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"90⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b891⤵PID:1520
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"92⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b893⤵PID:1752
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"94⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b895⤵PID:1148
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"96⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b897⤵PID:888
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"98⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b899⤵PID:1184
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"100⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8101⤵PID:1364
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"102⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8103⤵PID:552
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"104⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8105⤵PID:900
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"106⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8107⤵PID:848
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"108⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8109⤵PID:1324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"110⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8111⤵PID:1256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"112⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8113⤵PID:1524
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"114⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8115⤵PID:1796
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"116⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8117⤵PID:1160
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"118⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8119⤵PID:272
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"120⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8.exeC:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8121⤵PID:1316
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\c24601317ac7790b94552d94d91e93b8"122⤵
- Modifies visibility of file extensions in Explorer
PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-