Analysis
-
max time kernel
150s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
84a996a9c0a556exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
84a996a9c0a556exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
84a996a9c0a556exeexeexeex.exe
-
Size
924KB
-
MD5
84a996a9c0a55690f93766fa618f35bb
-
SHA1
129fcfa22a88e34a3f2f45aab10f053c84374034
-
SHA256
7419095325efd38397dfafa713e196ded539052f4a86459b56da1b1bd2701dc6
-
SHA512
3cbd9951b62f92d44813fcc1c9a07f59cad6475c261fa6fb26501d6c0a4a431c0102e5259b31e356c49387a3dc67c89320856d0c579a0d947fe8a04204403b69
-
SSDEEP
24576:82NEVgJ4EJhUKfP0Bkd45aKEWXCUgDrMwPpmELy:8EjJVJhBIkybSUgDVhL
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\RestartUse.png.exe NAUEQYkg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Control Panel\International\Geo\Nation NAUEQYkg.exe -
Deletes itself 1 IoCs
pid Process 2712 Process not Found -
Executes dropped EXE 2 IoCs
pid Process 2292 NAUEQYkg.exe 2192 ZSoQskUo.exe -
Loads dropped DLL 20 IoCs
pid Process 3008 84a996a9c0a556exeexeexeex.exe 3008 84a996a9c0a556exeexeexeex.exe 3008 84a996a9c0a556exeexeexeex.exe 3008 84a996a9c0a556exeexeexeex.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZSoQskUo.exe = "C:\\ProgramData\\zwEIQsUw\\ZSoQskUo.exe" 84a996a9c0a556exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Run\NAUEQYkg.exe = "C:\\Users\\Admin\\qYYogwUk\\NAUEQYkg.exe" NAUEQYkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZSoQskUo.exe = "C:\\ProgramData\\zwEIQsUw\\ZSoQskUo.exe" ZSoQskUo.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Run\nUEMYEww.exe = "C:\\Users\\Admin\\zGYQcAMM\\nUEMYEww.exe" 84a996a9c0a556exeexeexeex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zaYAksgY.exe = "C:\\ProgramData\\zOcUkcsQ\\zaYAksgY.exe" 84a996a9c0a556exeexeexeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Windows\CurrentVersion\Run\NAUEQYkg.exe = "C:\\Users\\Admin\\qYYogwUk\\NAUEQYkg.exe" 84a996a9c0a556exeexeexeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2632 2244 WerFault.exe 259 1400 1360 WerFault.exe 260 -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2532 reg.exe 2212 reg.exe 2620 reg.exe 2884 reg.exe 1724 reg.exe 2564 Process not Found 1984 reg.exe 2152 reg.exe 1868 reg.exe 2740 reg.exe 1276 reg.exe 2420 reg.exe 1900 reg.exe 524 reg.exe 1756 reg.exe 2340 reg.exe 2668 reg.exe 2868 reg.exe 1912 reg.exe 2152 reg.exe 2752 reg.exe 1624 reg.exe 524 reg.exe 2336 reg.exe 1940 reg.exe 1008 reg.exe 2992 reg.exe 2684 reg.exe 588 Process not Found 3028 reg.exe 2788 reg.exe 1748 reg.exe 2280 Process not Found 1720 Process not Found 2420 reg.exe 856 reg.exe 2408 reg.exe 2312 reg.exe 2404 reg.exe 2840 reg.exe 2824 reg.exe 472 reg.exe 2372 reg.exe 2716 reg.exe 592 reg.exe 1204 reg.exe 1500 reg.exe 1840 reg.exe 2080 reg.exe 2752 reg.exe 1288 reg.exe 2804 reg.exe 1288 reg.exe 1608 reg.exe 2336 reg.exe 2892 reg.exe 2820 reg.exe 1720 reg.exe 2536 Process not Found 2112 reg.exe 1912 reg.exe 1916 reg.exe 2672 reg.exe 2320 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 84a996a9c0a556exeexeexeex.exe 3008 84a996a9c0a556exeexeexeex.exe 2288 84a996a9c0a556exeexeexeex.exe 2288 84a996a9c0a556exeexeexeex.exe 2612 84a996a9c0a556exeexeexeex.exe 2612 84a996a9c0a556exeexeexeex.exe 2492 84a996a9c0a556exeexeexeex.exe 2492 84a996a9c0a556exeexeexeex.exe 2844 84a996a9c0a556exeexeexeex.exe 2844 84a996a9c0a556exeexeexeex.exe 2936 84a996a9c0a556exeexeexeex.exe 2936 84a996a9c0a556exeexeexeex.exe 1884 84a996a9c0a556exeexeexeex.exe 1884 84a996a9c0a556exeexeexeex.exe 2252 84a996a9c0a556exeexeexeex.exe 2252 84a996a9c0a556exeexeexeex.exe 1716 84a996a9c0a556exeexeexeex.exe 1716 84a996a9c0a556exeexeexeex.exe 2572 84a996a9c0a556exeexeexeex.exe 2572 84a996a9c0a556exeexeexeex.exe 2796 84a996a9c0a556exeexeexeex.exe 2796 84a996a9c0a556exeexeexeex.exe 2696 84a996a9c0a556exeexeexeex.exe 2696 84a996a9c0a556exeexeexeex.exe 2344 84a996a9c0a556exeexeexeex.exe 2344 84a996a9c0a556exeexeexeex.exe 2240 84a996a9c0a556exeexeexeex.exe 2240 84a996a9c0a556exeexeexeex.exe 1624 84a996a9c0a556exeexeexeex.exe 1624 84a996a9c0a556exeexeexeex.exe 1324 84a996a9c0a556exeexeexeex.exe 1324 84a996a9c0a556exeexeexeex.exe 2592 84a996a9c0a556exeexeexeex.exe 2592 84a996a9c0a556exeexeexeex.exe 1912 84a996a9c0a556exeexeexeex.exe 1912 84a996a9c0a556exeexeexeex.exe 1724 84a996a9c0a556exeexeexeex.exe 1724 84a996a9c0a556exeexeexeex.exe 2752 84a996a9c0a556exeexeexeex.exe 2752 84a996a9c0a556exeexeexeex.exe 824 84a996a9c0a556exeexeexeex.exe 824 84a996a9c0a556exeexeexeex.exe 2012 84a996a9c0a556exeexeexeex.exe 2012 84a996a9c0a556exeexeexeex.exe 1944 84a996a9c0a556exeexeexeex.exe 1944 84a996a9c0a556exeexeexeex.exe 584 84a996a9c0a556exeexeexeex.exe 584 84a996a9c0a556exeexeexeex.exe 636 84a996a9c0a556exeexeexeex.exe 636 84a996a9c0a556exeexeexeex.exe 1676 84a996a9c0a556exeexeexeex.exe 1676 84a996a9c0a556exeexeexeex.exe 1452 84a996a9c0a556exeexeexeex.exe 1452 84a996a9c0a556exeexeexeex.exe 1816 84a996a9c0a556exeexeexeex.exe 1816 84a996a9c0a556exeexeexeex.exe 1592 84a996a9c0a556exeexeexeex.exe 1592 84a996a9c0a556exeexeexeex.exe 2028 84a996a9c0a556exeexeexeex.exe 2028 84a996a9c0a556exeexeexeex.exe 2056 84a996a9c0a556exeexeexeex.exe 2056 84a996a9c0a556exeexeexeex.exe 2964 84a996a9c0a556exeexeexeex.exe 2964 84a996a9c0a556exeexeexeex.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe 2292 NAUEQYkg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2292 3008 84a996a9c0a556exeexeexeex.exe 29 PID 3008 wrote to memory of 2292 3008 84a996a9c0a556exeexeexeex.exe 29 PID 3008 wrote to memory of 2292 3008 84a996a9c0a556exeexeexeex.exe 29 PID 3008 wrote to memory of 2292 3008 84a996a9c0a556exeexeexeex.exe 29 PID 3008 wrote to memory of 2192 3008 84a996a9c0a556exeexeexeex.exe 30 PID 3008 wrote to memory of 2192 3008 84a996a9c0a556exeexeexeex.exe 30 PID 3008 wrote to memory of 2192 3008 84a996a9c0a556exeexeexeex.exe 30 PID 3008 wrote to memory of 2192 3008 84a996a9c0a556exeexeexeex.exe 30 PID 3008 wrote to memory of 2392 3008 84a996a9c0a556exeexeexeex.exe 31 PID 3008 wrote to memory of 2392 3008 84a996a9c0a556exeexeexeex.exe 31 PID 3008 wrote to memory of 2392 3008 84a996a9c0a556exeexeexeex.exe 31 PID 3008 wrote to memory of 2392 3008 84a996a9c0a556exeexeexeex.exe 31 PID 2392 wrote to memory of 2288 2392 cmd.exe 33 PID 2392 wrote to memory of 2288 2392 cmd.exe 33 PID 2392 wrote to memory of 2288 2392 cmd.exe 33 PID 2392 wrote to memory of 2288 2392 cmd.exe 33 PID 3008 wrote to memory of 1928 3008 84a996a9c0a556exeexeexeex.exe 34 PID 3008 wrote to memory of 1928 3008 84a996a9c0a556exeexeexeex.exe 34 PID 3008 wrote to memory of 1928 3008 84a996a9c0a556exeexeexeex.exe 34 PID 3008 wrote to memory of 1928 3008 84a996a9c0a556exeexeexeex.exe 34 PID 3008 wrote to memory of 2080 3008 84a996a9c0a556exeexeexeex.exe 35 PID 3008 wrote to memory of 2080 3008 84a996a9c0a556exeexeexeex.exe 35 PID 3008 wrote to memory of 2080 3008 84a996a9c0a556exeexeexeex.exe 35 PID 3008 wrote to memory of 2080 3008 84a996a9c0a556exeexeexeex.exe 35 PID 3008 wrote to memory of 2348 3008 84a996a9c0a556exeexeexeex.exe 37 PID 3008 wrote to memory of 2348 3008 84a996a9c0a556exeexeexeex.exe 37 PID 3008 wrote to memory of 2348 3008 84a996a9c0a556exeexeexeex.exe 37 PID 3008 wrote to memory of 2348 3008 84a996a9c0a556exeexeexeex.exe 37 PID 3008 wrote to memory of 1496 3008 84a996a9c0a556exeexeexeex.exe 40 PID 3008 wrote to memory of 1496 3008 84a996a9c0a556exeexeexeex.exe 40 PID 3008 wrote to memory of 1496 3008 84a996a9c0a556exeexeexeex.exe 40 PID 3008 wrote to memory of 1496 3008 84a996a9c0a556exeexeexeex.exe 40 PID 1496 wrote to memory of 2196 1496 cmd.exe 42 PID 1496 wrote to memory of 2196 1496 cmd.exe 42 PID 1496 wrote to memory of 2196 1496 cmd.exe 42 PID 1496 wrote to memory of 2196 1496 cmd.exe 42 PID 2288 wrote to memory of 2368 2288 84a996a9c0a556exeexeexeex.exe 43 PID 2288 wrote to memory of 2368 2288 84a996a9c0a556exeexeexeex.exe 43 PID 2288 wrote to memory of 2368 2288 84a996a9c0a556exeexeexeex.exe 43 PID 2288 wrote to memory of 2368 2288 84a996a9c0a556exeexeexeex.exe 43 PID 2368 wrote to memory of 2612 2368 cmd.exe 45 PID 2368 wrote to memory of 2612 2368 cmd.exe 45 PID 2368 wrote to memory of 2612 2368 cmd.exe 45 PID 2368 wrote to memory of 2612 2368 cmd.exe 45 PID 2288 wrote to memory of 2668 2288 84a996a9c0a556exeexeexeex.exe 46 PID 2288 wrote to memory of 2668 2288 84a996a9c0a556exeexeexeex.exe 46 PID 2288 wrote to memory of 2668 2288 84a996a9c0a556exeexeexeex.exe 46 PID 2288 wrote to memory of 2668 2288 84a996a9c0a556exeexeexeex.exe 46 PID 2288 wrote to memory of 2740 2288 84a996a9c0a556exeexeexeex.exe 49 PID 2288 wrote to memory of 2740 2288 84a996a9c0a556exeexeexeex.exe 49 PID 2288 wrote to memory of 2740 2288 84a996a9c0a556exeexeexeex.exe 49 PID 2288 wrote to memory of 2740 2288 84a996a9c0a556exeexeexeex.exe 49 PID 2288 wrote to memory of 2660 2288 84a996a9c0a556exeexeexeex.exe 48 PID 2288 wrote to memory of 2660 2288 84a996a9c0a556exeexeexeex.exe 48 PID 2288 wrote to memory of 2660 2288 84a996a9c0a556exeexeexeex.exe 48 PID 2288 wrote to memory of 2660 2288 84a996a9c0a556exeexeexeex.exe 48 PID 2288 wrote to memory of 2596 2288 84a996a9c0a556exeexeexeex.exe 53 PID 2288 wrote to memory of 2596 2288 84a996a9c0a556exeexeexeex.exe 53 PID 2288 wrote to memory of 2596 2288 84a996a9c0a556exeexeexeex.exe 53 PID 2288 wrote to memory of 2596 2288 84a996a9c0a556exeexeexeex.exe 53 PID 2596 wrote to memory of 2940 2596 cmd.exe 54 PID 2596 wrote to memory of 2940 2596 cmd.exe 54 PID 2596 wrote to memory of 2940 2596 cmd.exe 54 PID 2596 wrote to memory of 2940 2596 cmd.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\qYYogwUk\NAUEQYkg.exe"C:\Users\Admin\qYYogwUk\NAUEQYkg.exe"2⤵
- Modifies extensions of user files
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:2292
-
-
C:\ProgramData\zwEIQsUw\ZSoQskUo.exe"C:\ProgramData\zwEIQsUw\ZSoQskUo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2192
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"4⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"6⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"8⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"10⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"12⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"14⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"16⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"18⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"20⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"22⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"24⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"26⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"28⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex29⤵
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"30⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"32⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"34⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"36⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex37⤵
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"38⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex39⤵
- Adds Run key to start application
PID:2184 -
C:\Users\Admin\zGYQcAMM\nUEMYEww.exe"C:\Users\Admin\zGYQcAMM\nUEMYEww.exe"40⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 3641⤵
- Program crash
PID:2632
-
-
-
C:\ProgramData\zOcUkcsQ\zaYAksgY.exe"C:\ProgramData\zOcUkcsQ\zaYAksgY.exe"40⤵PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 3641⤵
- Program crash
PID:1400
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"40⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"42⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex43⤵
- Suspicious behavior: EnumeratesProcesses
PID:824 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"44⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"46⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex47⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"48⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex49⤵
- Suspicious behavior: EnumeratesProcesses
PID:584 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"50⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex51⤵
- Suspicious behavior: EnumeratesProcesses
PID:636 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"52⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"54⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"56⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"58⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"60⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex61⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"62⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"64⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex65⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"66⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex67⤵PID:1452
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"68⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex69⤵PID:2032
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"70⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex71⤵PID:2548
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"72⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex73⤵PID:2612
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"74⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex75⤵PID:1372
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"76⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex77⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"78⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex79⤵PID:2092
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"80⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex81⤵PID:2800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex83⤵PID:3032
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"84⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex85⤵PID:1712
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"86⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex87⤵PID:2692
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"88⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex89⤵PID:1928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"90⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex91⤵PID:1800
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"92⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex93⤵PID:2504
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"94⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex95⤵PID:1460
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"96⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex97⤵PID:1328
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"98⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex99⤵PID:2856
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"100⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex101⤵PID:2484
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"102⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex103⤵PID:2732
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"104⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex105⤵PID:2428
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"106⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex107⤵PID:1780
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"108⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex109⤵PID:2628
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"110⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex111⤵PID:1984
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"112⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex113⤵PID:2728
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"114⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex115⤵PID:1356
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"116⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex117⤵PID:1056
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex119⤵PID:2272
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"120⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex.exeC:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex121⤵PID:2928
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\84a996a9c0a556exeexeexeex"122⤵PID:524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-