Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
cbeb8a1dc9c1cc99182866d178ecaea8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cbeb8a1dc9c1cc99182866d178ecaea8.exe
Resource
win10v2004-20230220-en
General
-
Target
cbeb8a1dc9c1cc99182866d178ecaea8.exe
-
Size
189KB
-
MD5
cbeb8a1dc9c1cc99182866d178ecaea8
-
SHA1
4fed98767f06ef15b165c4baa69ac9adfbcfc794
-
SHA256
f94a87a6b2201c05a4222db550ce2ea96991165ee8b3c25af7bfeb5a8bbd8d51
-
SHA512
0b46422897e1e0302fc29e3a7625fea0b929eefc4ca506616bc7456596e8520bfb047aaa73baf304991bddb6dfca6bf93673b5738555ad40e00f8ee6d60d80b5
-
SSDEEP
3072:TxoZBytUbHRMDHJA8rXlm+TjeVfsHSz26jk:FoZB+Uj8X4+6sHSi6jk
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation lockoQMo.exe -
Executes dropped EXE 3 IoCs
pid Process 4368 BiskQYsU.exe 1268 lockoQMo.exe 4288 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lockoQMo.exe = "C:\\ProgramData\\PywIIEEw\\lockoQMo.exe" lockoQMo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BiskQYsU.exe = "C:\\Users\\Admin\\SoYIMcwk\\BiskQYsU.exe" BiskQYsU.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hSMowkUM.exe = "C:\\Users\\Admin\\PyAwYsUs\\hSMowkUM.exe" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fIkEscUE.exe = "C:\\ProgramData\\DmIEAcUc\\fIkEscUE.exe" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hSMowkUM.exe = "C:\\Users\\Admin\\PyAwYsUs\\hSMowkUM.exe" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fIkEscUE.exe = "C:\\ProgramData\\DmIEAcUc\\fIkEscUE.exe" Conhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BiskQYsU.exe = "C:\\Users\\Admin\\SoYIMcwk\\BiskQYsU.exe" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lockoQMo.exe = "C:\\ProgramData\\PywIIEEw\\lockoQMo.exe" cbeb8a1dc9c1cc99182866d178ecaea8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbeb8a1dc9c1cc99182866d178ecaea8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe lockoQMo.exe File created C:\Windows\SysWOW64\shell32.dll.exe lockoQMo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 4344 336 WerFault.exe 147 4624 2244 WerFault.exe 146 3344 2384 WerFault.exe 1179 1724 4288 WerFault.exe 1182 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 5036 reg.exe 2300 reg.exe 4384 reg.exe 960 reg.exe 2748 reg.exe 1032 reg.exe 2244 reg.exe 4208 reg.exe 5096 reg.exe 2496 reg.exe 60 reg.exe 4948 reg.exe 5116 reg.exe 1448 reg.exe 1784 reg.exe 5016 reg.exe 4892 reg.exe 4724 reg.exe 3004 reg.exe 4416 reg.exe 1512 reg.exe 4552 reg.exe 3844 reg.exe 336 reg.exe 4304 reg.exe 4148 reg.exe 4192 reg.exe 1508 reg.exe 1428 reg.exe 4168 reg.exe 4280 reg.exe 4148 reg.exe 4148 reg.exe 4944 Process not Found 3920 reg.exe 2232 reg.exe 4448 reg.exe 2700 reg.exe 4688 reg.exe 4376 reg.exe 404 reg.exe 4596 reg.exe 3188 reg.exe 3312 reg.exe 4148 reg.exe 3440 reg.exe 1292 reg.exe 3928 reg.exe 3688 reg.exe 4580 reg.exe 4436 reg.exe 3776 reg.exe 4468 Process not Found 1068 Process not Found 4180 reg.exe 3780 reg.exe 4020 reg.exe 2660 reg.exe 616 reg.exe 1656 reg.exe 1764 reg.exe 1488 reg.exe 4704 reg.exe 3720 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3696 reg.exe 3696 reg.exe 3696 reg.exe 3696 reg.exe 3144 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3144 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3144 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3144 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4308 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4308 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4308 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4308 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3248 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3248 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3248 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3248 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3376 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3376 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3376 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3376 cbeb8a1dc9c1cc99182866d178ecaea8.exe 1508 reg.exe 1508 reg.exe 1508 reg.exe 1508 reg.exe 4180 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4180 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4180 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4180 cbeb8a1dc9c1cc99182866d178ecaea8.exe 2136 cbeb8a1dc9c1cc99182866d178ecaea8.exe 2136 cbeb8a1dc9c1cc99182866d178ecaea8.exe 2136 cbeb8a1dc9c1cc99182866d178ecaea8.exe 2136 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4128 Conhost.exe 4128 Conhost.exe 4128 Conhost.exe 4128 Conhost.exe 4980 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4980 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4980 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4980 cbeb8a1dc9c1cc99182866d178ecaea8.exe 3908 Conhost.exe 3908 Conhost.exe 3908 Conhost.exe 3908 Conhost.exe 4896 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4896 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4896 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4896 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4020 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4020 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4020 cbeb8a1dc9c1cc99182866d178ecaea8.exe 4020 cbeb8a1dc9c1cc99182866d178ecaea8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1268 lockoQMo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe 1268 lockoQMo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4368 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 84 PID 4152 wrote to memory of 4368 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 84 PID 4152 wrote to memory of 4368 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 84 PID 4152 wrote to memory of 1268 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 85 PID 4152 wrote to memory of 1268 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 85 PID 4152 wrote to memory of 1268 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 85 PID 4152 wrote to memory of 1704 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 86 PID 4152 wrote to memory of 1704 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 86 PID 4152 wrote to memory of 1704 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 86 PID 4152 wrote to memory of 1412 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 88 PID 4152 wrote to memory of 1412 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 88 PID 4152 wrote to memory of 1412 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 88 PID 4152 wrote to memory of 1764 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 94 PID 4152 wrote to memory of 1764 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 94 PID 4152 wrote to memory of 1764 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 94 PID 4152 wrote to memory of 1784 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 90 PID 4152 wrote to memory of 1784 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 90 PID 4152 wrote to memory of 1784 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 90 PID 4152 wrote to memory of 2436 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 89 PID 4152 wrote to memory of 2436 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 89 PID 4152 wrote to memory of 2436 4152 cbeb8a1dc9c1cc99182866d178ecaea8.exe 89 PID 1704 wrote to memory of 1448 1704 cmd.exe 96 PID 1704 wrote to memory of 1448 1704 cmd.exe 96 PID 1704 wrote to memory of 1448 1704 cmd.exe 96 PID 1448 wrote to memory of 2120 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 97 PID 1448 wrote to memory of 2120 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 97 PID 1448 wrote to memory of 2120 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 97 PID 2436 wrote to memory of 4644 2436 cmd.exe 98 PID 2436 wrote to memory of 4644 2436 cmd.exe 98 PID 2436 wrote to memory of 4644 2436 cmd.exe 98 PID 1448 wrote to memory of 4168 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 107 PID 1448 wrote to memory of 4168 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 107 PID 1448 wrote to memory of 4168 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 107 PID 1448 wrote to memory of 2132 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 106 PID 1448 wrote to memory of 2132 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 106 PID 1448 wrote to memory of 2132 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 106 PID 1448 wrote to memory of 1060 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 101 PID 1448 wrote to memory of 1060 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 101 PID 1448 wrote to memory of 1060 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 101 PID 1448 wrote to memory of 3892 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 100 PID 1448 wrote to memory of 3892 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 100 PID 1448 wrote to memory of 3892 1448 cbeb8a1dc9c1cc99182866d178ecaea8.exe 100 PID 2120 wrote to memory of 1504 2120 cmd.exe 109 PID 2120 wrote to memory of 1504 2120 cmd.exe 109 PID 2120 wrote to memory of 1504 2120 cmd.exe 109 PID 3892 wrote to memory of 3268 3892 cmd.exe 108 PID 3892 wrote to memory of 3268 3892 cmd.exe 108 PID 3892 wrote to memory of 3268 3892 cmd.exe 108 PID 1504 wrote to memory of 4812 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 110 PID 1504 wrote to memory of 4812 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 110 PID 1504 wrote to memory of 4812 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 110 PID 1504 wrote to memory of 5048 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 112 PID 1504 wrote to memory of 5048 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 112 PID 1504 wrote to memory of 5048 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 112 PID 1504 wrote to memory of 3816 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 120 PID 1504 wrote to memory of 3816 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 120 PID 1504 wrote to memory of 3816 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 120 PID 1504 wrote to memory of 4724 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 119 PID 1504 wrote to memory of 4724 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 119 PID 1504 wrote to memory of 4724 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 119 PID 1504 wrote to memory of 4456 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 118 PID 1504 wrote to memory of 4456 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 118 PID 1504 wrote to memory of 4456 1504 cbeb8a1dc9c1cc99182866d178ecaea8.exe 118 PID 4812 wrote to memory of 3696 4812 cmd.exe 114 -
System policy modification 1 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbeb8a1dc9c1cc99182866d178ecaea8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbeb8a1dc9c1cc99182866d178ecaea8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cbeb8a1dc9c1cc99182866d178ecaea8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exe"C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\SoYIMcwk\BiskQYsU.exe"C:\Users\Admin\SoYIMcwk\BiskQYsU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4368
-
-
C:\ProgramData\PywIIEEw\lockoQMo.exe"C:\ProgramData\PywIIEEw\lockoQMo.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"4⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea85⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"6⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea87⤵PID:3696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"8⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea89⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"10⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea811⤵
- Adds Run key to start application
PID:2660 -
C:\Users\Admin\PyAwYsUs\hSMowkUM.exe"C:\Users\Admin\PyAwYsUs\hSMowkUM.exe"12⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 22413⤵
- Program crash
PID:4624
-
-
-
C:\ProgramData\DmIEAcUc\fIkEscUE.exe"C:\ProgramData\DmIEAcUc\fIkEscUE.exe"12⤵PID:336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 22413⤵
- Program crash
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"12⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea813⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"14⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea815⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"16⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea817⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"18⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea819⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"20⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea821⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"22⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea823⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"24⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea825⤵PID:4128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"26⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea827⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"28⤵PID:3640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea829⤵PID:3908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"30⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea831⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"32⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea833⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"34⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea835⤵PID:4456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"36⤵PID:336
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
- Modifies visibility of file extensions in Explorer
PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea837⤵PID:3996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"38⤵PID:1548
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea839⤵
- Checks whether UAC is enabled
- System policy modification
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"40⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea841⤵PID:4372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"42⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea843⤵PID:3148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"44⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea845⤵PID:4664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"46⤵PID:3144
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea847⤵PID:1504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"48⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea849⤵PID:1700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"50⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea851⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"52⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea853⤵PID:3268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"54⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea855⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"56⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea857⤵PID:2316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"58⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea859⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"60⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea861⤵PID:5064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"62⤵PID:1232
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:3484
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea863⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"64⤵PID:3380
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:4176
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea865⤵PID:4092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"66⤵PID:3892
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV167⤵PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea867⤵PID:2132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"68⤵PID:4316
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea869⤵PID:3640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"70⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea871⤵PID:3672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"72⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea873⤵PID:1900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"74⤵PID:3268
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea875⤵PID:2640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"76⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea877⤵PID:2016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"78⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea879⤵PID:2176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"80⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea881⤵PID:3816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"82⤵PID:4580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea883⤵PID:1032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"84⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea885⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"86⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea887⤵PID:1164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"88⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea889⤵PID:3208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"90⤵PID:4092
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
- Modifies visibility of file extensions in Explorer
PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea891⤵PID:5068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"92⤵PID:656
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:2120
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea893⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"94⤵PID:4532
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea895⤵PID:5040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"96⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea897⤵PID:2832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"98⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea899⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"100⤵PID:2156
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8101⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"102⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8103⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"104⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8105⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"106⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8107⤵PID:1096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"108⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8109⤵PID:4580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"110⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8111⤵PID:1032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"112⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:616 -
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8113⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"114⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8115⤵PID:4204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"116⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8117⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"118⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8119⤵PID:4424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"120⤵PID:4640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1121⤵PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8.exeC:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8121⤵PID:1032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cbeb8a1dc9c1cc99182866d178ecaea8"122⤵PID:4828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-