Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2023, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
72fa596bea9904exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
72fa596bea9904exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
72fa596bea9904exeexeexeex.exe
-
Size
196KB
-
MD5
72fa596bea99044869b1fb4837edd93f
-
SHA1
f3d93b71db69ed0c6cc4c16a502a5a724f9f9ea6
-
SHA256
50710a837e7e04b0ca0672729a2d18aca8f2820e9f16071ac43f604fdb2c9308
-
SHA512
d7237f31458e5c66cbfabc77d9858c53578028ef30e63aca1c1de08f1ed55fc7673bde861188dea80dccc42c060df522b15ba5a8bbd0a7e963ec6b299b82bcf2
-
SSDEEP
3072:o24UhzMGVrQN3m9vxC4/zgDXRMRPcStGonSj+o/LCES/sK9cJvuXoOf:oBUK8QNeCczyRMxntGonSaIytyw4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 60 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backgroundTaskHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 72fa596bea9904exeexeexeex.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" backgroundTaskHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation NAwEUEYU.exe -
Executes dropped EXE 2 IoCs
pid Process 956 NAwEUEYU.exe 2032 SyYAoAgU.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SyYAoAgU.exe = "C:\\ProgramData\\lIgUssUM\\SyYAoAgU.exe" SyYAoAgU.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NAwEUEYU.exe = "C:\\Users\\Admin\\bMUkEAQk\\NAwEUEYU.exe" 72fa596bea9904exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SyYAoAgU.exe = "C:\\ProgramData\\lIgUssUM\\SyYAoAgU.exe" 72fa596bea9904exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NAwEUEYU.exe = "C:\\Users\\Admin\\bMUkEAQk\\NAwEUEYU.exe" NAwEUEYU.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe NAwEUEYU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 5104 reg.exe 3832 reg.exe 5008 reg.exe 3836 reg.exe 1368 reg.exe 1232 reg.exe 4716 reg.exe 1528 reg.exe 3344 reg.exe 4044 reg.exe 1176 reg.exe 5004 reg.exe 3780 reg.exe 4932 reg.exe 2044 reg.exe 1176 reg.exe 4340 reg.exe 1008 reg.exe 1320 reg.exe 2392 reg.exe 5104 reg.exe 3748 reg.exe 4632 reg.exe 3052 reg.exe 3792 reg.exe 2716 reg.exe 2056 reg.exe 4984 reg.exe 4600 reg.exe 3500 reg.exe 3664 reg.exe 1628 reg.exe 3392 reg.exe 3832 reg.exe 4432 reg.exe 4644 reg.exe 2452 reg.exe 2156 reg.exe 1708 reg.exe 2304 reg.exe 2184 reg.exe 3832 reg.exe 2044 reg.exe 4548 reg.exe 392 reg.exe 2180 reg.exe 1160 reg.exe 2240 reg.exe 3712 reg.exe 2388 reg.exe 3248 reg.exe 2272 reg.exe 4292 reg.exe 1916 reg.exe 3168 reg.exe 1464 reg.exe 536 reg.exe 4092 reg.exe 3164 reg.exe 1928 reg.exe 3908 reg.exe 1200 reg.exe 4592 reg.exe 3908 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4288 72fa596bea9904exeexeexeex.exe 4288 72fa596bea9904exeexeexeex.exe 4288 72fa596bea9904exeexeexeex.exe 4288 72fa596bea9904exeexeexeex.exe 1200 72fa596bea9904exeexeexeex.exe 1200 72fa596bea9904exeexeexeex.exe 1200 72fa596bea9904exeexeexeex.exe 1200 72fa596bea9904exeexeexeex.exe 3964 72fa596bea9904exeexeexeex.exe 3964 72fa596bea9904exeexeexeex.exe 3964 72fa596bea9904exeexeexeex.exe 3964 72fa596bea9904exeexeexeex.exe 4772 Conhost.exe 4772 Conhost.exe 4772 Conhost.exe 4772 Conhost.exe 988 Conhost.exe 988 Conhost.exe 988 Conhost.exe 988 Conhost.exe 4256 Conhost.exe 4256 Conhost.exe 4256 Conhost.exe 4256 Conhost.exe 3812 72fa596bea9904exeexeexeex.exe 3812 72fa596bea9904exeexeexeex.exe 3812 72fa596bea9904exeexeexeex.exe 3812 72fa596bea9904exeexeexeex.exe 4464 72fa596bea9904exeexeexeex.exe 4464 72fa596bea9904exeexeexeex.exe 4464 72fa596bea9904exeexeexeex.exe 4464 72fa596bea9904exeexeexeex.exe 2724 72fa596bea9904exeexeexeex.exe 2724 72fa596bea9904exeexeexeex.exe 2724 72fa596bea9904exeexeexeex.exe 2724 72fa596bea9904exeexeexeex.exe 3788 72fa596bea9904exeexeexeex.exe 3788 72fa596bea9904exeexeexeex.exe 3788 72fa596bea9904exeexeexeex.exe 3788 72fa596bea9904exeexeexeex.exe 4988 72fa596bea9904exeexeexeex.exe 4988 72fa596bea9904exeexeexeex.exe 4988 72fa596bea9904exeexeexeex.exe 4988 72fa596bea9904exeexeexeex.exe 3352 cmd.exe 3352 cmd.exe 3352 cmd.exe 3352 cmd.exe 4460 72fa596bea9904exeexeexeex.exe 4460 72fa596bea9904exeexeexeex.exe 4460 72fa596bea9904exeexeexeex.exe 4460 72fa596bea9904exeexeexeex.exe 2484 reg.exe 2484 reg.exe 2484 reg.exe 2484 reg.exe 4436 72fa596bea9904exeexeexeex.exe 4436 72fa596bea9904exeexeexeex.exe 4436 72fa596bea9904exeexeexeex.exe 4436 72fa596bea9904exeexeexeex.exe 2112 72fa596bea9904exeexeexeex.exe 2112 72fa596bea9904exeexeexeex.exe 2112 72fa596bea9904exeexeexeex.exe 2112 72fa596bea9904exeexeexeex.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 956 NAwEUEYU.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe 956 NAwEUEYU.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 956 4288 72fa596bea9904exeexeexeex.exe 86 PID 4288 wrote to memory of 956 4288 72fa596bea9904exeexeexeex.exe 86 PID 4288 wrote to memory of 956 4288 72fa596bea9904exeexeexeex.exe 86 PID 4288 wrote to memory of 2032 4288 72fa596bea9904exeexeexeex.exe 87 PID 4288 wrote to memory of 2032 4288 72fa596bea9904exeexeexeex.exe 87 PID 4288 wrote to memory of 2032 4288 72fa596bea9904exeexeexeex.exe 87 PID 4288 wrote to memory of 4984 4288 72fa596bea9904exeexeexeex.exe 88 PID 4288 wrote to memory of 4984 4288 72fa596bea9904exeexeexeex.exe 88 PID 4288 wrote to memory of 4984 4288 72fa596bea9904exeexeexeex.exe 88 PID 4288 wrote to memory of 1368 4288 72fa596bea9904exeexeexeex.exe 90 PID 4288 wrote to memory of 1368 4288 72fa596bea9904exeexeexeex.exe 90 PID 4288 wrote to memory of 1368 4288 72fa596bea9904exeexeexeex.exe 90 PID 4288 wrote to memory of 1324 4288 72fa596bea9904exeexeexeex.exe 96 PID 4288 wrote to memory of 1324 4288 72fa596bea9904exeexeexeex.exe 96 PID 4288 wrote to memory of 1324 4288 72fa596bea9904exeexeexeex.exe 96 PID 4288 wrote to memory of 2804 4288 72fa596bea9904exeexeexeex.exe 92 PID 4288 wrote to memory of 2804 4288 72fa596bea9904exeexeexeex.exe 92 PID 4288 wrote to memory of 2804 4288 72fa596bea9904exeexeexeex.exe 92 PID 4288 wrote to memory of 1116 4288 72fa596bea9904exeexeexeex.exe 94 PID 4288 wrote to memory of 1116 4288 72fa596bea9904exeexeexeex.exe 94 PID 4288 wrote to memory of 1116 4288 72fa596bea9904exeexeexeex.exe 94 PID 4984 wrote to memory of 1200 4984 cmd.exe 98 PID 4984 wrote to memory of 1200 4984 cmd.exe 98 PID 4984 wrote to memory of 1200 4984 cmd.exe 98 PID 1116 wrote to memory of 5080 1116 cmd.exe 100 PID 1116 wrote to memory of 5080 1116 cmd.exe 100 PID 1116 wrote to memory of 5080 1116 cmd.exe 100 PID 1200 wrote to memory of 2868 1200 72fa596bea9904exeexeexeex.exe 101 PID 1200 wrote to memory of 2868 1200 72fa596bea9904exeexeexeex.exe 101 PID 1200 wrote to memory of 2868 1200 72fa596bea9904exeexeexeex.exe 101 PID 1200 wrote to memory of 3168 1200 72fa596bea9904exeexeexeex.exe 108 PID 1200 wrote to memory of 3168 1200 72fa596bea9904exeexeexeex.exe 108 PID 1200 wrote to memory of 3168 1200 72fa596bea9904exeexeexeex.exe 108 PID 1200 wrote to memory of 1320 1200 72fa596bea9904exeexeexeex.exe 107 PID 1200 wrote to memory of 1320 1200 72fa596bea9904exeexeexeex.exe 107 PID 1200 wrote to memory of 1320 1200 72fa596bea9904exeexeexeex.exe 107 PID 1200 wrote to memory of 1160 1200 72fa596bea9904exeexeexeex.exe 106 PID 1200 wrote to memory of 1160 1200 72fa596bea9904exeexeexeex.exe 106 PID 1200 wrote to memory of 1160 1200 72fa596bea9904exeexeexeex.exe 106 PID 1200 wrote to memory of 3936 1200 72fa596bea9904exeexeexeex.exe 102 PID 1200 wrote to memory of 3936 1200 72fa596bea9904exeexeexeex.exe 102 PID 1200 wrote to memory of 3936 1200 72fa596bea9904exeexeexeex.exe 102 PID 2868 wrote to memory of 3964 2868 cmd.exe 111 PID 2868 wrote to memory of 3964 2868 cmd.exe 111 PID 2868 wrote to memory of 3964 2868 cmd.exe 111 PID 3936 wrote to memory of 4604 3936 cmd.exe 112 PID 3936 wrote to memory of 4604 3936 cmd.exe 112 PID 3936 wrote to memory of 4604 3936 cmd.exe 112 PID 3964 wrote to memory of 1276 3964 72fa596bea9904exeexeexeex.exe 113 PID 3964 wrote to memory of 1276 3964 72fa596bea9904exeexeexeex.exe 113 PID 3964 wrote to memory of 1276 3964 72fa596bea9904exeexeexeex.exe 113 PID 3964 wrote to memory of 5024 3964 72fa596bea9904exeexeexeex.exe 115 PID 3964 wrote to memory of 5024 3964 72fa596bea9904exeexeexeex.exe 115 PID 3964 wrote to memory of 5024 3964 72fa596bea9904exeexeexeex.exe 115 PID 3964 wrote to memory of 3792 3964 72fa596bea9904exeexeexeex.exe 118 PID 3964 wrote to memory of 3792 3964 72fa596bea9904exeexeexeex.exe 118 PID 3964 wrote to memory of 3792 3964 72fa596bea9904exeexeexeex.exe 118 PID 3964 wrote to memory of 3780 3964 72fa596bea9904exeexeexeex.exe 117 PID 3964 wrote to memory of 3780 3964 72fa596bea9904exeexeexeex.exe 117 PID 3964 wrote to memory of 3780 3964 72fa596bea9904exeexeexeex.exe 117 PID 3964 wrote to memory of 4424 3964 72fa596bea9904exeexeexeex.exe 116 PID 3964 wrote to memory of 4424 3964 72fa596bea9904exeexeexeex.exe 116 PID 3964 wrote to memory of 4424 3964 72fa596bea9904exeexeexeex.exe 116 PID 1276 wrote to memory of 4772 1276 cmd.exe 177 -
System policy modification 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\bMUkEAQk\NAwEUEYU.exe"C:\Users\Admin\bMUkEAQk\NAwEUEYU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:956
-
-
C:\ProgramData\lIgUssUM\SyYAoAgU.exe"C:\ProgramData\lIgUssUM\SyYAoAgU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"6⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex7⤵PID:4772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"8⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex9⤵PID:988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"10⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex11⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"12⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"14⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"16⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"18⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"20⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"22⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex23⤵PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"24⤵PID:3320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"26⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex27⤵PID:2484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"28⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"30⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"32⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex33⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"34⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex35⤵PID:4672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"36⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex37⤵PID:2156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"38⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex39⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"40⤵PID:3640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
- UAC bypass
PID:3344
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex41⤵PID:1820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"42⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex43⤵PID:376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"44⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex45⤵PID:992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"46⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex47⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"48⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex49⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"50⤵PID:1368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
- Modifies visibility of file extensions in Explorer
PID:2392
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex51⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"52⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex53⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"54⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex55⤵PID:1464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"56⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex57⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"58⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex59⤵PID:4616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"60⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex61⤵PID:3740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"62⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex63⤵PID:3100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"64⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex65⤵PID:1408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"66⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex67⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"68⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex69⤵PID:1148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"70⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex71⤵PID:2992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"72⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex73⤵PID:2204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"74⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex75⤵PID:4636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"76⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex77⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"78⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex79⤵PID:1008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"80⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex81⤵PID:4200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"82⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex83⤵PID:4716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"84⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex85⤵
- Modifies visibility of file extensions in Explorer
PID:892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"86⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex87⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"88⤵PID:2272
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
- UAC bypass
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex89⤵PID:3660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"90⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex91⤵PID:396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"92⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex93⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"94⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex95⤵PID:2384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"96⤵PID:2724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex97⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"98⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex99⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"100⤵PID:2964
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
- UAC bypass
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex101⤵PID:1716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"102⤵PID:3076
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex103⤵PID:3248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"104⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex105⤵PID:1464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"106⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex107⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"108⤵PID:4420
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
- Modifies visibility of file extensions in Explorer
PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex109⤵PID:4912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"110⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex111⤵PID:3052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"112⤵PID:3912
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
- UAC bypass
PID:4548
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex113⤵PID:3392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"114⤵PID:2300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:988
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex115⤵PID:1972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"116⤵
- Modifies visibility of file extensions in Explorer
PID:4084 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex117⤵PID:880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"118⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex119⤵PID:3916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"120⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex121⤵PID:1368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72fa596bea9904exeexeexeex"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-