Analysis
-
max time kernel
166s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.109fa502460e4de811c37349c38e4530.exe
Resource
win7-20231023-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.109fa502460e4de811c37349c38e4530.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.109fa502460e4de811c37349c38e4530.exe
-
Size
125KB
-
MD5
109fa502460e4de811c37349c38e4530
-
SHA1
94ab37f3608246628f4f0c58d68d9edfb88e09ec
-
SHA256
87d163134eec22ff34870d4883be78ccadf0cbbfabd64aefcc8d5722406359cd
-
SHA512
4296259739d6942313d50a1f68176e74e34e9b00784c7fe45beb1c93735ff7f5f8bb67db3595cc7f839abc5417aceccb13a12284c8a8f08d9af159e20b715ac2
-
SSDEEP
3072:qghTvS/U82Uo74wUeE+DhgrMje7gPszWhBlDeKUiiVeyWeIhhBOt:rS8jrU6DRMWhBcK1ZE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\ftps.exe" sychost.exe -
Executes dropped EXE 64 IoCs
pid Process 2224 sychost.exe 2112 sychost.exe 2684 sychost.exe 2636 sychost.exe 2780 sychost.exe 2652 sychost.exe 2644 sychost.exe 2496 sychost.exe 2212 sychost.exe 2256 sychost.exe 1860 sychost.exe 336 sychost.exe 1384 sychost.exe 2744 sychost.exe 2732 sychost.exe 2812 sychost.exe 1096 sychost.exe 2820 sychost.exe 1968 sychost.exe 796 sychost.exe 1964 sychost.exe 1956 sychost.exe 1324 sychost.exe 2232 sychost.exe 320 sychost.exe 2400 sychost.exe 1788 sychost.exe 2240 sychost.exe 588 sychost.exe 1880 sychost.exe 1620 sychost.exe 2164 sychost.exe 2844 sychost.exe 2428 sychost.exe 1444 sychost.exe 848 sychost.exe 2924 sychost.exe 2576 sychost.exe 2992 sychost.exe 2852 sychost.exe 2032 sychost.exe 2352 sychost.exe 2452 sychost.exe 1780 sychost.exe 2324 sychost.exe 2184 sychost.exe 348 sychost.exe 1816 sychost.exe 3004 sychost.exe 1040 sychost.exe 2136 sychost.exe 2096 sychost.exe 440 sychost.exe 1328 sychost.exe 1540 sychost.exe 1760 sychost.exe 2548 sychost.exe 1784 sychost.exe 372 sychost.exe 844 sychost.exe 2092 sychost.exe 1660 sychost.exe 1048 sychost.exe 640 sychost.exe -
Loads dropped DLL 64 IoCs
pid Process 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 2224 sychost.exe 2224 sychost.exe 2112 sychost.exe 2112 sychost.exe 2684 sychost.exe 2684 sychost.exe 2636 sychost.exe 2636 sychost.exe 2780 sychost.exe 2780 sychost.exe 2652 sychost.exe 2652 sychost.exe 2644 sychost.exe 2644 sychost.exe 2496 sychost.exe 2496 sychost.exe 2212 sychost.exe 2212 sychost.exe 2256 sychost.exe 2256 sychost.exe 1860 sychost.exe 1860 sychost.exe 336 sychost.exe 336 sychost.exe 1384 sychost.exe 1384 sychost.exe 2744 sychost.exe 2744 sychost.exe 2732 sychost.exe 2732 sychost.exe 2812 sychost.exe 2812 sychost.exe 1096 sychost.exe 1096 sychost.exe 2820 sychost.exe 2820 sychost.exe 1968 sychost.exe 1968 sychost.exe 796 sychost.exe 796 sychost.exe 1964 sychost.exe 1964 sychost.exe 1956 sychost.exe 1956 sychost.exe 1324 sychost.exe 1324 sychost.exe 2232 sychost.exe 2232 sychost.exe 320 sychost.exe 320 sychost.exe 2400 sychost.exe 2400 sychost.exe 1788 sychost.exe 1788 sychost.exe 2240 sychost.exe 2240 sychost.exe 588 sychost.exe 588 sychost.exe 1880 sychost.exe 1880 sychost.exe 1620 sychost.exe 1620 sychost.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\windows update = "C:\\Windows\\system32\\sychost.exe" sychost.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe sychost.exe File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe Process not Found File opened for modification C:\Windows\SysWOW64\telnets.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File created C:\Windows\SysWOW64\sychost.exe sychost.exe File created C:\Windows\SysWOW64\sychost.exe sychost.exe File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found File opened for modification C:\Windows\SysWOW64\ftps.exe Process not Found -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sychost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\telnets.exe %1" sychost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2224 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 27 PID 2384 wrote to memory of 2224 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 27 PID 2384 wrote to memory of 2224 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 27 PID 2384 wrote to memory of 2224 2384 NEAS.109fa502460e4de811c37349c38e4530.exe 27 PID 2224 wrote to memory of 2112 2224 sychost.exe 28 PID 2224 wrote to memory of 2112 2224 sychost.exe 28 PID 2224 wrote to memory of 2112 2224 sychost.exe 28 PID 2224 wrote to memory of 2112 2224 sychost.exe 28 PID 2112 wrote to memory of 2684 2112 sychost.exe 29 PID 2112 wrote to memory of 2684 2112 sychost.exe 29 PID 2112 wrote to memory of 2684 2112 sychost.exe 29 PID 2112 wrote to memory of 2684 2112 sychost.exe 29 PID 2684 wrote to memory of 2636 2684 sychost.exe 30 PID 2684 wrote to memory of 2636 2684 sychost.exe 30 PID 2684 wrote to memory of 2636 2684 sychost.exe 30 PID 2684 wrote to memory of 2636 2684 sychost.exe 30 PID 2636 wrote to memory of 2780 2636 sychost.exe 31 PID 2636 wrote to memory of 2780 2636 sychost.exe 31 PID 2636 wrote to memory of 2780 2636 sychost.exe 31 PID 2636 wrote to memory of 2780 2636 sychost.exe 31 PID 2780 wrote to memory of 2652 2780 sychost.exe 32 PID 2780 wrote to memory of 2652 2780 sychost.exe 32 PID 2780 wrote to memory of 2652 2780 sychost.exe 32 PID 2780 wrote to memory of 2652 2780 sychost.exe 32 PID 2652 wrote to memory of 2644 2652 sychost.exe 33 PID 2652 wrote to memory of 2644 2652 sychost.exe 33 PID 2652 wrote to memory of 2644 2652 sychost.exe 33 PID 2652 wrote to memory of 2644 2652 sychost.exe 33 PID 2644 wrote to memory of 2496 2644 sychost.exe 34 PID 2644 wrote to memory of 2496 2644 sychost.exe 34 PID 2644 wrote to memory of 2496 2644 sychost.exe 34 PID 2644 wrote to memory of 2496 2644 sychost.exe 34 PID 2496 wrote to memory of 2212 2496 sychost.exe 35 PID 2496 wrote to memory of 2212 2496 sychost.exe 35 PID 2496 wrote to memory of 2212 2496 sychost.exe 35 PID 2496 wrote to memory of 2212 2496 sychost.exe 35 PID 2212 wrote to memory of 2256 2212 sychost.exe 36 PID 2212 wrote to memory of 2256 2212 sychost.exe 36 PID 2212 wrote to memory of 2256 2212 sychost.exe 36 PID 2212 wrote to memory of 2256 2212 sychost.exe 36 PID 2256 wrote to memory of 1860 2256 sychost.exe 37 PID 2256 wrote to memory of 1860 2256 sychost.exe 37 PID 2256 wrote to memory of 1860 2256 sychost.exe 37 PID 2256 wrote to memory of 1860 2256 sychost.exe 37 PID 1860 wrote to memory of 336 1860 sychost.exe 38 PID 1860 wrote to memory of 336 1860 sychost.exe 38 PID 1860 wrote to memory of 336 1860 sychost.exe 38 PID 1860 wrote to memory of 336 1860 sychost.exe 38 PID 336 wrote to memory of 1384 336 sychost.exe 39 PID 336 wrote to memory of 1384 336 sychost.exe 39 PID 336 wrote to memory of 1384 336 sychost.exe 39 PID 336 wrote to memory of 1384 336 sychost.exe 39 PID 1384 wrote to memory of 2744 1384 sychost.exe 40 PID 1384 wrote to memory of 2744 1384 sychost.exe 40 PID 1384 wrote to memory of 2744 1384 sychost.exe 40 PID 1384 wrote to memory of 2744 1384 sychost.exe 40 PID 2744 wrote to memory of 2732 2744 sychost.exe 41 PID 2744 wrote to memory of 2732 2744 sychost.exe 41 PID 2744 wrote to memory of 2732 2744 sychost.exe 41 PID 2744 wrote to memory of 2732 2744 sychost.exe 41 PID 2732 wrote to memory of 2812 2732 sychost.exe 42 PID 2732 wrote to memory of 2812 2732 sychost.exe 42 PID 2732 wrote to memory of 2812 2732 sychost.exe 42 PID 2732 wrote to memory of 2812 2732 sychost.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.109fa502460e4de811c37349c38e4530.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.109fa502460e4de811c37349c38e4530.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1956 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe33⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe34⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe35⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe36⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe37⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe38⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe39⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe40⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe41⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe42⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe43⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe44⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe45⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe46⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe47⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe48⤵
- Executes dropped EXE
PID:348 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe49⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe50⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe51⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe52⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe53⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe54⤵
- Executes dropped EXE
PID:440 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe55⤵
- Executes dropped EXE
PID:1328 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe56⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe57⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe58⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe59⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe60⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe61⤵
- Executes dropped EXE
PID:844 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe62⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe63⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe64⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe65⤵
- Executes dropped EXE
PID:640 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe66⤵PID:928
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe67⤵PID:2152
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe68⤵PID:1764
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe69⤵PID:2332
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe70⤵PID:2440
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe71⤵PID:1992
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe72⤵
- Modifies WinLogon for persistence
PID:2376 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe73⤵PID:1996
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe74⤵PID:864
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe75⤵PID:1728
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe76⤵PID:1600
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe77⤵PID:872
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe78⤵PID:2560
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe79⤵PID:2340
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe80⤵PID:2860
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe81⤵PID:2220
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe82⤵PID:3008
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe83⤵PID:2024
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe84⤵PID:2856
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe85⤵PID:2188
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe86⤵PID:1560
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe87⤵PID:2796
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe88⤵PID:1288
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe89⤵PID:2624
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe90⤵PID:2680
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe91⤵PID:2632
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe92⤵PID:2676
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe93⤵PID:2872
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe94⤵PID:2808
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe95⤵PID:2592
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe96⤵PID:2708
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe97⤵PID:2600
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe98⤵PID:2228
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe99⤵PID:2484
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe100⤵PID:808
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe101⤵PID:568
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe102⤵PID:780
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe103⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:768 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe104⤵PID:1588
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe105⤵PID:2760
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe106⤵PID:1576
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe107⤵PID:1684
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe108⤵PID:2580
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe109⤵PID:1940
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe110⤵PID:1260
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe111⤵PID:1312
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe112⤵PID:1960
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe113⤵PID:1636
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe114⤵PID:2424
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe115⤵PID:1428
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe116⤵PID:1408
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe117⤵
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe118⤵
- Adds Run key to start application
PID:2312 -
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe119⤵PID:2124
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe120⤵PID:2104
-
C:\Windows\SysWOW64\sychost.exeC:\Windows\system32\sychost.exe121⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-