7edf44694ea438f9f23a04f42f31adb7aadf2e887848a1f7e5c8b56bb04d3c7a

Analysis

max time kernel
3s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

420c3fddb569a10e301d69dd05f1bd63.exe
Size

361KB
MD5

420c3fddb569a10e301d69dd05f1bd63
SHA1

39b84948f28695c2313822682e580c18803e2c9e
SHA256

7edf44694ea438f9f23a04f42f31adb7aadf2e887848a1f7e5c8b56bb04d3c7a
SHA512

0526f0dadaf16bf923d1d9ae38036537ccb0b5a7d79ae4942b255b0b2e8110ef436a5a1201673f9eb1e35bd733abd29cf1fe1924959f68442524634b6689b02d
SSDEEP

6144:CMflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXJ:vflfAsiVGjSGecvX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	pjhbztrmjecwuomg.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1604	ipconfig.exe
1864	ipconfig.exe
1980	ipconfig.exe
4432	ipconfig.exe
2548	ipconfig.exe
3516	ipconfig.exe
4788	ipconfig.exe
932	ipconfig.exe
2060	ipconfig.exe
4992	ipconfig.exe
1936	ipconfig.exe
4684	ipconfig.exe
4632	ipconfig.exe
224	ipconfig.exe
4756	ipconfig.exe
4508	ipconfig.exe
1724	ipconfig.exe
3648	ipconfig.exe
3064	ipconfig.exe
2588	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{34B7D6CE-A444-11EE-9963-76CF25FE979C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2912	pjhbztrmjecwuomg.exe
2912	pjhbztrmjecwuomg.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe
2724	420c3fddb569a10e301d69dd05f1bd63.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2912	2724	420c3fddb569a10e301d69dd05f1bd63.exe	84
PID 2724 wrote to memory of 2912	2724	420c3fddb569a10e301d69dd05f1bd63.exe	84
PID 2724 wrote to memory of 2912	2724	420c3fddb569a10e301d69dd05f1bd63.exe	84
PID 2724 wrote to memory of 1660	2724	420c3fddb569a10e301d69dd05f1bd63.exe	82
PID 2724 wrote to memory of 1660	2724	420c3fddb569a10e301d69dd05f1bd63.exe	82
PID 1660 wrote to memory of 116	1660	iexplore.exe	83
PID 1660 wrote to memory of 116	1660	iexplore.exe	83
PID 1660 wrote to memory of 116	1660	iexplore.exe	83

C:\Users\Admin\AppData\Local\Temp\420c3fddb569a10e301d69dd05f1bd63.exe
"C:\Users\Admin\AppData\Local\Temp\420c3fddb569a10e301d69dd05f1bd63.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:17410 /prefetch:2
    3⤵
    PID:116
- C:\Temp\pjhbztrmjecwuomg.exe
  C:\Temp\pjhbztrmjecwuomg.exe run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    PID:3380
  - - C:\temp\CreateProcess.exe
      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run
    3⤵
    PID:3136
  - - C:\Temp\oigbytqljd.exe
      C:\Temp\oigbytqljd.exe ups_run
      4⤵
      PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run
    3⤵
    PID:744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    PID:1952
  - - C:\windows\system32\ipconfig.exe
      C:\windows\system32\ipconfig.exe /release
      4⤵
      Gathers network information
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    PID:4608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    PID:2228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurmkecwu.exe ups_run
    3⤵
    PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurmkecwu.exe ups_ins
    3⤵
    PID:4084
  - - C:\Temp\i_nifaxsqkic.exe
      C:\Temp\i_nifaxsqkic.exe ups_ins
      4⤵
      PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmjecw.exe ups_run
    3⤵
    PID:688
  - - C:\Temp\kidavtnlfd.exe
      C:\Temp\kidavtnlfd.exe ups_run
      4⤵
      PID:2224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmjecw.exe ups_ins
    3⤵
    PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    PID:4388
  - - C:\Temp\dbwtomgeyw.exe
      C:\Temp\dbwtomgeyw.exe ups_run
      4⤵
      PID:868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    PID:552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    PID:212
  - - C:\Temp\gaysqlidbv.exe
      C:\Temp\gaysqlidbv.exe ups_run
      4⤵
      PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    PID:688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run
    3⤵
    PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins
    3⤵
    PID:4084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upkhcamkec.exe ups_run
    3⤵
    PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upkhcamkec.exe ups_ins
    3⤵
    PID:3876
  - - C:\Temp\i_upkhcamkec.exe
      C:\Temp\i_upkhcamkec.exe ups_ins
      4⤵
      PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    PID:3164
  - - C:\Temp\i_pjhbzurmke.exe
      C:\Temp\i_pjhbzurmke.exe ups_ins
      4⤵
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    PID:3636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrlje.exe ups_run
    3⤵
    PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrlje.exe ups_ins
    3⤵
    PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    PID:792
  - - C:\Temp\i_qojgbztrlj.exe
      C:\Temp\i_qojgbztrlj.exe ups_ins
      4⤵
      PID:3876
- C:\windows\system32\ipconfig.exe
  C:\windows\system32\ipconfig.exe /release
  2⤵
  - Gathers network information
  PID:1724

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:2060

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:5052

C:\Temp\wuomgeywro.exe
C:\Temp\wuomgeywro.exe ups_run
1⤵
PID:548

C:\Temp\i_wuomgeywro.exe
C:\Temp\i_wuomgeywro.exe ups_ins
1⤵
PID:1984

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4992

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:4148

C:\Temp\ljdbwtomge.exe
C:\Temp\ljdbwtomge.exe ups_run
1⤵
PID:376

C:\Temp\i_ljdbwtomge.exe
C:\Temp\i_ljdbwtomge.exe ups_ins
1⤵
PID:5100

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4508

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:3832

C:\Temp\i_oigbytqljd.exe
C:\Temp\i_oigbytqljd.exe ups_ins
1⤵
PID:2824

C:\Temp\oigaysqlid.exe
C:\Temp\oigaysqlid.exe ups_run
1⤵
PID:3956
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:2168

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:1864

C:\Temp\i_oigaysqlid.exe
C:\Temp\i_oigaysqlid.exe ups_ins
1⤵
PID:4696
- C:\Temp\pjhbzurmke.exe
  C:\Temp\pjhbzurmke.exe ups_run
  2⤵
  PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
    3⤵
    PID:464

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:2724

C:\Temp\sqkidavsnl.exe
C:\Temp\sqkidavsnl.exe ups_run
1⤵
PID:4632

C:\Temp\i_sqkidavsnl.exe
C:\Temp\i_sqkidavsnl.exe ups_ins
1⤵
PID:548

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:3648

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:4772

C:\Temp\nkfdxvpnif.exe
C:\Temp\nkfdxvpnif.exe ups_run
1⤵
PID:3060

C:\Temp\i_nkfdxvpnif.exe
C:\Temp\i_nkfdxvpnif.exe ups_ins
1⤵
PID:3600

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:3064

C:\Temp\kfcxvpnhfz.exe
C:\Temp\kfcxvpnhfz.exe ups_run
1⤵
PID:3380

C:\Temp\i_kfcxvpnhfz.exe
C:\Temp\i_kfcxvpnhfz.exe ups_ins
1⤵
PID:5100

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:2588

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:1524

C:\Temp\bzurmkecwu.exe
C:\Temp\bzurmkecwu.exe ups_run
1⤵
PID:4564

C:\Temp\i_bzurmkecwu.exe
C:\Temp\i_bzurmkecwu.exe ups_ins
1⤵
PID:4848

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:224

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:5108

C:\Temp\hbzurmjecw.exe
C:\Temp\hbzurmjecw.exe ups_run
1⤵
PID:932

C:\Temp\i_hbzurmjecw.exe
C:\Temp\i_hbzurmjecw.exe ups_ins
1⤵
PID:4580

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4756

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:1392

C:\Temp\i_dbwtomgeyw.exe
C:\Temp\i_dbwtomgeyw.exe ups_ins
1⤵
PID:4832

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:1980

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:1320

C:\Temp\gbytrljdbv.exe
C:\Temp\gbytrljdbv.exe ups_run
1⤵
PID:2784

C:\Temp\i_gbytrljdbv.exe
C:\Temp\i_gbytrljdbv.exe ups_ins
1⤵
PID:3948

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:1952

C:\Temp\i_gaysqlidbv.exe
C:\Temp\i_gaysqlidbv.exe ups_ins
1⤵
PID:376

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:1936

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:1560

C:\Temp\i_kidavtnlfd.exe
C:\Temp\i_kidavtnlfd.exe ups_ins
1⤵
PID:532

C:\Temp\nifaxsqkic.exe
C:\Temp\nifaxsqkic.exe ups_run
1⤵
PID:2072
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:2256

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:2548

C:\Temp\nhfzxspkic.exe
C:\Temp\nhfzxspkic.exe ups_run
1⤵
PID:1396
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:2296

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4788

C:\Temp\i_nhfzxspkic.exe
C:\Temp\i_nhfzxspkic.exe ups_ins
1⤵
PID:1372

C:\Temp\upkhcamkec.exe
C:\Temp\upkhcamkec.exe ups_run
1⤵
PID:1472
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:5112

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:932

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:3516

C:\Temp\pjhbzurmje.exe
C:\Temp\pjhbzurmje.exe ups_run
1⤵
PID:2848
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:4584

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4684

C:\Temp\i_pjhbzurmje.exe
C:\Temp\i_pjhbzurmje.exe ups_ins
1⤵
PID:4252

C:\Temp\ojgbztrlje.exe
C:\Temp\ojgbztrlje.exe ups_run
1⤵
PID:1868
- C:\temp\CreateProcess.exe
  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
  2⤵
  PID:2820

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:4632

C:\Temp\i_ojgbztrlje.exe
C:\Temp\i_ojgbztrlje.exe ups_ins
1⤵
PID:2396

C:\windows\system32\ipconfig.exe
C:\windows\system32\ipconfig.exe /release
1⤵
- Gathers network information
PID:1604

C:\temp\CreateProcess.exe
C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
1⤵
PID:4932

C:\Temp\qojgbztrlj.exe
C:\Temp\qojgbztrlj.exe ups_run
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...