Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:01
Behavioral task
behavioral1
Sample
0c6307b80f5acf61a0e06ae4c9b39fb3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c6307b80f5acf61a0e06ae4c9b39fb3.exe
Resource
win10v2004-20231215-en
General
-
Target
0c6307b80f5acf61a0e06ae4c9b39fb3.exe
-
Size
359KB
-
MD5
0c6307b80f5acf61a0e06ae4c9b39fb3
-
SHA1
a140261ce770a05f9e8efd09da10b71ee12cd383
-
SHA256
48922a2f0149c0474a2afd0e57644bc6ac88189b4fb15ab525a7d02b752211e9
-
SHA512
5c0ff8f434e3592a1a7a04199d8402da907b220df9c4442dafb94af40a588798a5f3439adfececbc1684f59b449d77018cdf3644c15d21345adf77ef328c557d
-
SSDEEP
6144:b/SPrz92Mq38sFRZe//Srzez2otvqvxv5vKvLv8vtvHv3vyvxvyvEvPv6v4viMm:Asd1E/+ez2L1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1028 oCRZHgu.exe 2144 oCRZHgu.exe 2088 oCRZHgu.exe 2812 oCRZHgu.exe 2696 oCRZHgu.exe 2732 oCRZHgu.exe 2768 oCRZHgu.exe 2596 oCRZHgu.exe 2740 oCRZHgu.exe 2576 oCRZHgu.exe 2648 oCRZHgu.exe 2616 oCRZHgu.exe 1200 oCRZHgu.exe 552 oCRZHgu.exe 1468 oCRZHgu.exe 1176 oCRZHgu.exe 2888 oCRZHgu.exe 2924 oCRZHgu.exe 2928 oCRZHgu.exe 848 oCRZHgu.exe 960 oCRZHgu.exe 1964 oCRZHgu.exe 1224 oCRZHgu.exe 2208 oCRZHgu.exe 2272 oCRZHgu.exe 2180 oCRZHgu.exe 1096 oCRZHgu.exe 944 oCRZHgu.exe 1496 oCRZHgu.exe 892 oCRZHgu.exe 1924 oCRZHgu.exe 1584 oCRZHgu.exe 2628 oCRZHgu.exe 1668 oCRZHgu.exe 2760 oCRZHgu.exe 1196 oCRZHgu.exe 2420 oCRZHgu.exe 1640 oCRZHgu.exe 1680 oCRZHgu.exe 1532 oCRZHgu.exe 1276 oCRZHgu.exe 1772 oCRZHgu.exe 2108 oCRZHgu.exe 2064 oCRZHgu.exe 2480 oCRZHgu.exe 2308 oCRZHgu.exe 1960 oCRZHgu.exe 3012 oCRZHgu.exe 788 oCRZHgu.exe 380 oCRZHgu.exe 2436 oCRZHgu.exe 2264 oCRZHgu.exe 596 oCRZHgu.exe 528 oCRZHgu.exe 1516 oCRZHgu.exe 1064 oCRZHgu.exe 1620 oCRZHgu.exe 436 oCRZHgu.exe 2068 oCRZHgu.exe 2364 oCRZHgu.exe 2256 oCRZHgu.exe 2012 oCRZHgu.exe 1812 oCRZHgu.exe 1904 oCRZHgu.exe -
Loads dropped DLL 64 IoCs
pid Process 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 1028 oCRZHgu.exe 1028 oCRZHgu.exe 2144 oCRZHgu.exe 2144 oCRZHgu.exe 2088 oCRZHgu.exe 2088 oCRZHgu.exe 2812 oCRZHgu.exe 2812 oCRZHgu.exe 2696 oCRZHgu.exe 2696 oCRZHgu.exe 2732 oCRZHgu.exe 2732 oCRZHgu.exe 2768 oCRZHgu.exe 2768 oCRZHgu.exe 2596 oCRZHgu.exe 2596 oCRZHgu.exe 2740 oCRZHgu.exe 2740 oCRZHgu.exe 2576 oCRZHgu.exe 2576 oCRZHgu.exe 2648 oCRZHgu.exe 2648 oCRZHgu.exe 2616 oCRZHgu.exe 2616 oCRZHgu.exe 1200 oCRZHgu.exe 1200 oCRZHgu.exe 552 oCRZHgu.exe 552 oCRZHgu.exe 1468 oCRZHgu.exe 1468 oCRZHgu.exe 1176 oCRZHgu.exe 1176 oCRZHgu.exe 2888 oCRZHgu.exe 2888 oCRZHgu.exe 2924 oCRZHgu.exe 2924 oCRZHgu.exe 2928 oCRZHgu.exe 2928 oCRZHgu.exe 848 oCRZHgu.exe 848 oCRZHgu.exe 960 oCRZHgu.exe 960 oCRZHgu.exe 1964 oCRZHgu.exe 1964 oCRZHgu.exe 1224 oCRZHgu.exe 1224 oCRZHgu.exe 2208 oCRZHgu.exe 2208 oCRZHgu.exe 2272 oCRZHgu.exe 2272 oCRZHgu.exe 2180 oCRZHgu.exe 2180 oCRZHgu.exe 1096 oCRZHgu.exe 1096 oCRZHgu.exe 944 oCRZHgu.exe 944 oCRZHgu.exe 1496 oCRZHgu.exe 1496 oCRZHgu.exe 892 oCRZHgu.exe 892 oCRZHgu.exe 1924 oCRZHgu.exe 1924 oCRZHgu.exe -
resource yara_rule behavioral1/memory/776-0-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/files/0x0026000000016032-13.dat upx behavioral1/memory/1028-17-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2144-16-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2088-22-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2812-26-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2696-30-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2768-39-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/files/0x0026000000016032-42.dat upx behavioral1/memory/2596-43-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2732-44-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/776-33-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2740-52-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/files/0x0026000000016032-51.dat upx behavioral1/memory/2576-53-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2144-54-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/files/0x0026000000016032-55.dat upx behavioral1/memory/2648-59-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2616-64-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2088-62-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2696-69-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1200-73-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/552-77-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1468-81-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1176-82-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/776-103-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1028-104-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2144-105-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2696-106-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2732-107-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2812-108-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2088-109-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2596-110-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2768-111-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2740-112-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1468-113-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2648-114-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2616-115-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/552-116-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2576-117-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1200-118-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/848-120-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1176-119-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2928-121-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2628-122-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1496-123-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1224-124-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2888-125-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2180-126-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2924-127-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1924-129-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1668-128-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2760-130-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/892-131-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1584-132-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2208-133-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/1964-134-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2272-135-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/960-136-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/944-137-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: oCRZHgu.exe File opened (read-only) \??\k: oCRZHgu.exe File opened (read-only) \??\x: oCRZHgu.exe File opened (read-only) \??\o: oCRZHgu.exe File opened (read-only) \??\t: oCRZHgu.exe File opened (read-only) \??\k: oCRZHgu.exe File opened (read-only) \??\x: oCRZHgu.exe File opened (read-only) \??\g: oCRZHgu.exe File opened (read-only) \??\i: oCRZHgu.exe File opened (read-only) \??\q: oCRZHgu.exe File opened (read-only) \??\l: oCRZHgu.exe File opened (read-only) \??\u: oCRZHgu.exe File opened (read-only) \??\h: oCRZHgu.exe File opened (read-only) \??\x: oCRZHgu.exe File opened (read-only) \??\l: oCRZHgu.exe File opened (read-only) \??\y: oCRZHgu.exe File opened (read-only) \??\t: oCRZHgu.exe File opened (read-only) \??\j: oCRZHgu.exe File opened (read-only) \??\l: oCRZHgu.exe File opened (read-only) \??\k: oCRZHgu.exe File opened (read-only) \??\e: oCRZHgu.exe File opened (read-only) \??\y: oCRZHgu.exe File opened (read-only) \??\w: oCRZHgu.exe File opened (read-only) \??\s: oCRZHgu.exe File opened (read-only) \??\r: oCRZHgu.exe File opened (read-only) \??\j: oCRZHgu.exe File opened (read-only) \??\r: oCRZHgu.exe File opened (read-only) \??\g: oCRZHgu.exe File opened (read-only) \??\w: oCRZHgu.exe File opened (read-only) \??\z: oCRZHgu.exe File opened (read-only) \??\p: oCRZHgu.exe File opened (read-only) \??\h: oCRZHgu.exe File opened (read-only) \??\p: oCRZHgu.exe File opened (read-only) \??\z: oCRZHgu.exe File opened (read-only) \??\i: oCRZHgu.exe File opened (read-only) \??\s: oCRZHgu.exe File opened (read-only) \??\p: oCRZHgu.exe File opened (read-only) \??\q: oCRZHgu.exe File opened (read-only) \??\u: oCRZHgu.exe File opened (read-only) \??\q: oCRZHgu.exe File opened (read-only) \??\x: oCRZHgu.exe File opened (read-only) \??\v: oCRZHgu.exe File opened (read-only) \??\p: oCRZHgu.exe File opened (read-only) \??\z: oCRZHgu.exe File opened (read-only) \??\r: oCRZHgu.exe File opened (read-only) \??\y: oCRZHgu.exe File opened (read-only) \??\g: oCRZHgu.exe File opened (read-only) \??\m: oCRZHgu.exe File opened (read-only) \??\w: oCRZHgu.exe File opened (read-only) \??\u: oCRZHgu.exe File opened (read-only) \??\t: oCRZHgu.exe File opened (read-only) \??\y: 5aoOHOY.exe File opened (read-only) \??\r: oCRZHgu.exe File opened (read-only) \??\o: oCRZHgu.exe File opened (read-only) \??\v: 5aoOHOY.exe File opened (read-only) \??\e: oCRZHgu.exe File opened (read-only) \??\s: oCRZHgu.exe File opened (read-only) \??\u: oCRZHgu.exe File opened (read-only) \??\m: oCRZHgu.exe File opened (read-only) \??\h: oCRZHgu.exe File opened (read-only) \??\m: oCRZHgu.exe File opened (read-only) \??\k: oCRZHgu.exe File opened (read-only) \??\l: oCRZHgu.exe File opened (read-only) \??\t: 5aoOHOY.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe 5aoOHOY.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe 5aoOHOY.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe 5aoOHOY.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe 5aoOHOY.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe 5aoOHOY.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe File created C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exe oCRZHgu.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe Token: SeLoadDriverPrivilege 1028 oCRZHgu.exe Token: SeLoadDriverPrivilege 2144 oCRZHgu.exe Token: SeLoadDriverPrivilege 2088 oCRZHgu.exe Token: SeLoadDriverPrivilege 2812 oCRZHgu.exe Token: SeLoadDriverPrivilege 2696 oCRZHgu.exe Token: SeLoadDriverPrivilege 2732 oCRZHgu.exe Token: SeLoadDriverPrivilege 2768 oCRZHgu.exe Token: SeLoadDriverPrivilege 2596 oCRZHgu.exe Token: SeLoadDriverPrivilege 2740 oCRZHgu.exe Token: SeLoadDriverPrivilege 2576 oCRZHgu.exe Token: SeLoadDriverPrivilege 2648 oCRZHgu.exe Token: SeLoadDriverPrivilege 2616 oCRZHgu.exe Token: SeLoadDriverPrivilege 1200 oCRZHgu.exe Token: SeLoadDriverPrivilege 552 oCRZHgu.exe Token: SeLoadDriverPrivilege 1468 oCRZHgu.exe Token: SeLoadDriverPrivilege 1176 oCRZHgu.exe Token: SeLoadDriverPrivilege 2888 oCRZHgu.exe Token: SeLoadDriverPrivilege 2924 oCRZHgu.exe Token: SeLoadDriverPrivilege 2928 oCRZHgu.exe Token: SeLoadDriverPrivilege 848 oCRZHgu.exe Token: SeLoadDriverPrivilege 960 oCRZHgu.exe Token: SeLoadDriverPrivilege 1964 oCRZHgu.exe Token: SeLoadDriverPrivilege 1224 oCRZHgu.exe Token: SeLoadDriverPrivilege 2208 oCRZHgu.exe Token: SeLoadDriverPrivilege 2272 oCRZHgu.exe Token: SeLoadDriverPrivilege 2180 oCRZHgu.exe Token: SeLoadDriverPrivilege 1096 oCRZHgu.exe Token: SeLoadDriverPrivilege 944 oCRZHgu.exe Token: SeLoadDriverPrivilege 1496 oCRZHgu.exe Token: SeLoadDriverPrivilege 892 oCRZHgu.exe Token: SeLoadDriverPrivilege 1924 oCRZHgu.exe Token: SeLoadDriverPrivilege 1584 oCRZHgu.exe Token: SeLoadDriverPrivilege 2628 oCRZHgu.exe Token: SeLoadDriverPrivilege 1668 oCRZHgu.exe Token: SeLoadDriverPrivilege 2760 oCRZHgu.exe Token: SeLoadDriverPrivilege 1196 oCRZHgu.exe Token: SeLoadDriverPrivilege 2420 oCRZHgu.exe Token: SeLoadDriverPrivilege 1640 oCRZHgu.exe Token: SeLoadDriverPrivilege 1680 oCRZHgu.exe Token: SeLoadDriverPrivilege 1532 oCRZHgu.exe Token: SeLoadDriverPrivilege 1276 oCRZHgu.exe Token: SeLoadDriverPrivilege 1772 oCRZHgu.exe Token: SeLoadDriverPrivilege 2108 oCRZHgu.exe Token: SeLoadDriverPrivilege 2064 oCRZHgu.exe Token: SeLoadDriverPrivilege 2480 oCRZHgu.exe Token: SeLoadDriverPrivilege 2308 oCRZHgu.exe Token: SeLoadDriverPrivilege 1960 oCRZHgu.exe Token: SeLoadDriverPrivilege 3012 oCRZHgu.exe Token: SeLoadDriverPrivilege 788 oCRZHgu.exe Token: SeLoadDriverPrivilege 380 oCRZHgu.exe Token: SeLoadDriverPrivilege 2436 oCRZHgu.exe Token: SeLoadDriverPrivilege 2264 oCRZHgu.exe Token: SeLoadDriverPrivilege 596 oCRZHgu.exe Token: SeLoadDriverPrivilege 528 oCRZHgu.exe Token: SeLoadDriverPrivilege 1516 oCRZHgu.exe Token: SeLoadDriverPrivilege 1064 oCRZHgu.exe Token: SeLoadDriverPrivilege 1620 oCRZHgu.exe Token: SeLoadDriverPrivilege 436 oCRZHgu.exe Token: SeLoadDriverPrivilege 2068 oCRZHgu.exe Token: SeLoadDriverPrivilege 2364 oCRZHgu.exe Token: SeLoadDriverPrivilege 2256 oCRZHgu.exe Token: SeLoadDriverPrivilege 2012 oCRZHgu.exe Token: SeLoadDriverPrivilege 1812 oCRZHgu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 1028 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 28 PID 776 wrote to memory of 1028 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 28 PID 776 wrote to memory of 1028 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 28 PID 776 wrote to memory of 1028 776 0c6307b80f5acf61a0e06ae4c9b39fb3.exe 28 PID 1028 wrote to memory of 2144 1028 oCRZHgu.exe 29 PID 1028 wrote to memory of 2144 1028 oCRZHgu.exe 29 PID 1028 wrote to memory of 2144 1028 oCRZHgu.exe 29 PID 1028 wrote to memory of 2144 1028 oCRZHgu.exe 29 PID 2144 wrote to memory of 2088 2144 oCRZHgu.exe 30 PID 2144 wrote to memory of 2088 2144 oCRZHgu.exe 30 PID 2144 wrote to memory of 2088 2144 oCRZHgu.exe 30 PID 2144 wrote to memory of 2088 2144 oCRZHgu.exe 30 PID 2088 wrote to memory of 2812 2088 oCRZHgu.exe 31 PID 2088 wrote to memory of 2812 2088 oCRZHgu.exe 31 PID 2088 wrote to memory of 2812 2088 oCRZHgu.exe 31 PID 2088 wrote to memory of 2812 2088 oCRZHgu.exe 31 PID 2812 wrote to memory of 2696 2812 oCRZHgu.exe 32 PID 2812 wrote to memory of 2696 2812 oCRZHgu.exe 32 PID 2812 wrote to memory of 2696 2812 oCRZHgu.exe 32 PID 2812 wrote to memory of 2696 2812 oCRZHgu.exe 32 PID 2696 wrote to memory of 2732 2696 oCRZHgu.exe 33 PID 2696 wrote to memory of 2732 2696 oCRZHgu.exe 33 PID 2696 wrote to memory of 2732 2696 oCRZHgu.exe 33 PID 2696 wrote to memory of 2732 2696 oCRZHgu.exe 33 PID 2732 wrote to memory of 2768 2732 oCRZHgu.exe 34 PID 2732 wrote to memory of 2768 2732 oCRZHgu.exe 34 PID 2732 wrote to memory of 2768 2732 oCRZHgu.exe 34 PID 2732 wrote to memory of 2768 2732 oCRZHgu.exe 34 PID 2768 wrote to memory of 2596 2768 oCRZHgu.exe 36 PID 2768 wrote to memory of 2596 2768 oCRZHgu.exe 36 PID 2768 wrote to memory of 2596 2768 oCRZHgu.exe 36 PID 2768 wrote to memory of 2596 2768 oCRZHgu.exe 36 PID 2596 wrote to memory of 2740 2596 oCRZHgu.exe 35 PID 2596 wrote to memory of 2740 2596 oCRZHgu.exe 35 PID 2596 wrote to memory of 2740 2596 oCRZHgu.exe 35 PID 2596 wrote to memory of 2740 2596 oCRZHgu.exe 35 PID 2740 wrote to memory of 2576 2740 oCRZHgu.exe 37 PID 2740 wrote to memory of 2576 2740 oCRZHgu.exe 37 PID 2740 wrote to memory of 2576 2740 oCRZHgu.exe 37 PID 2740 wrote to memory of 2576 2740 oCRZHgu.exe 37 PID 2576 wrote to memory of 2648 2576 oCRZHgu.exe 38 PID 2576 wrote to memory of 2648 2576 oCRZHgu.exe 38 PID 2576 wrote to memory of 2648 2576 oCRZHgu.exe 38 PID 2576 wrote to memory of 2648 2576 oCRZHgu.exe 38 PID 2648 wrote to memory of 2616 2648 oCRZHgu.exe 39 PID 2648 wrote to memory of 2616 2648 oCRZHgu.exe 39 PID 2648 wrote to memory of 2616 2648 oCRZHgu.exe 39 PID 2648 wrote to memory of 2616 2648 oCRZHgu.exe 39 PID 2616 wrote to memory of 1200 2616 oCRZHgu.exe 40 PID 2616 wrote to memory of 1200 2616 oCRZHgu.exe 40 PID 2616 wrote to memory of 1200 2616 oCRZHgu.exe 40 PID 2616 wrote to memory of 1200 2616 oCRZHgu.exe 40 PID 1200 wrote to memory of 552 1200 oCRZHgu.exe 41 PID 1200 wrote to memory of 552 1200 oCRZHgu.exe 41 PID 1200 wrote to memory of 552 1200 oCRZHgu.exe 41 PID 1200 wrote to memory of 552 1200 oCRZHgu.exe 41 PID 552 wrote to memory of 1468 552 oCRZHgu.exe 42 PID 552 wrote to memory of 1468 552 oCRZHgu.exe 42 PID 552 wrote to memory of 1468 552 oCRZHgu.exe 42 PID 552 wrote to memory of 1468 552 oCRZHgu.exe 42 PID 1468 wrote to memory of 1176 1468 oCRZHgu.exe 43 PID 1468 wrote to memory of 1176 1468 oCRZHgu.exe 43 PID 1468 wrote to memory of 1176 1468 oCRZHgu.exe 43 PID 1468 wrote to memory of 1176 1468 oCRZHgu.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c6307b80f5acf61a0e06ae4c9b39fb3.exe"C:\Users\Admin\AppData\Local\Temp\0c6307b80f5acf61a0e06ae4c9b39fb3.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe10⤵
- Drops file in System32 directory
PID:12832 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe11⤵PID:12920
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe9⤵PID:12800
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵PID:12864
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe8⤵PID:12708
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵PID:12824
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵PID:14704
-
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe7⤵PID:12684
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵PID:12776
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵PID:13148
-
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe6⤵
- Enumerates connected drives
PID:12552 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵PID:12608
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵PID:12944
-
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe5⤵
- Enumerates connected drives
PID:12484
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe4⤵PID:12356
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe5⤵PID:12372
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe6⤵PID:12436
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵PID:12512
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵PID:12584
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵PID:12660
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵PID:12728
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe11⤵PID:13660
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe3⤵PID:12064
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe4⤵PID:12084
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe5⤵PID:12116
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe6⤵PID:12160
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵PID:12192
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵PID:12240
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵PID:12000
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵PID:12308
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe11⤵PID:12404
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe12⤵PID:12476
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe13⤵
- Drops file in System32 directory
PID:12536
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\oCRZHgu\5aoOHOY.exeC:\Windows\system32\oCRZHgu\5aoOHOY.exe2⤵PID:11988
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe3⤵PID:12028
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe4⤵PID:12052
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe5⤵
- Drops file in System32 directory
PID:12100 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe6⤵PID:12144
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵PID:12184
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵PID:12208
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵PID:12268
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵PID:11636
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe11⤵
- Drops file in System32 directory
PID:12336 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe12⤵PID:12396
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe13⤵PID:12448
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1176 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:960 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2208 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2064 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2308 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:596 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe46⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:528 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe56⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe57⤵PID:1652
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe58⤵PID:1184
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe59⤵PID:988
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe60⤵PID:1552
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe61⤵PID:796
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe62⤵PID:2452
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe63⤵PID:1800
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe64⤵PID:2440
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe65⤵PID:1360
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe66⤵PID:2112
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe67⤵PID:1832
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe68⤵PID:1664
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe69⤵PID:296
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe70⤵PID:1124
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe71⤵PID:2416
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe72⤵PID:1948
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe73⤵PID:1388
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe74⤵PID:108
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe75⤵PID:2024
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe76⤵PID:1244
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe77⤵PID:2140
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe78⤵PID:1624
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe79⤵PID:888
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe80⤵PID:876
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe81⤵PID:2228
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe82⤵
- Drops file in System32 directory
PID:1760 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe83⤵PID:1764
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe84⤵PID:1148
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe85⤵PID:3028
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe86⤵PID:2244
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe87⤵PID:1988
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe88⤵PID:1580
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe89⤵PID:1604
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe90⤵PID:3036
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe91⤵PID:2756
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe92⤵PID:2120
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe93⤵
- Enumerates connected drives
PID:2860 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe94⤵PID:2368
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe95⤵PID:2444
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe96⤵PID:2712
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe97⤵PID:2796
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe98⤵PID:2780
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe99⤵PID:2728
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe100⤵PID:2168
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe101⤵PID:1744
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe102⤵PID:2964
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe103⤵
- Enumerates connected drives
PID:2672 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe104⤵PID:2508
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe105⤵PID:2744
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe106⤵PID:2844
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe107⤵
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe108⤵PID:2624
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe109⤵PID:3064
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe110⤵PID:3068
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe111⤵PID:1032
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe112⤵PID:2392
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe113⤵PID:112
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe114⤵PID:1928
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe115⤵PID:772
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe116⤵PID:1792
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe117⤵PID:1648
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe118⤵PID:2556
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe119⤵PID:2172
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe120⤵PID:2236
-
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe121⤵
- Drops file in System32 directory
PID:2900 -
C:\Windows\SysWOW64\5aoOHOY\oCRZHgu.exeC:\Windows\system32\5aoOHOY\oCRZHgu.exe122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-