Analysis
-
max time kernel
165s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
11720d8fce40b7fdd68adbd307fbaa99.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
11720d8fce40b7fdd68adbd307fbaa99.exe
Resource
win10v2004-20231215-en
General
-
Target
11720d8fce40b7fdd68adbd307fbaa99.exe
-
Size
264KB
-
MD5
11720d8fce40b7fdd68adbd307fbaa99
-
SHA1
2df4acf6a19734a1cdfc78d65f2f22305d45c83e
-
SHA256
44a127ca39b9d0c4fa44434007423e1ca86c9c35c81cbc98773046538dd04944
-
SHA512
fdd3bf1c1cad36b385ba610a1d7ee844ed3369042d6b3502ada9861629f46d73fa9a798a401fb909ab2a36e2b16b010866e6fb50d3fc5a6e86b3ea6500643aef
-
SSDEEP
1536:2df1zwQVgNSMuVe6lhEMGIeqkSg+khEUpJYf1zwQVgvN76x+:2t1zwLNSMuVeHMGMkSgSUpJY1zwLvN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 64 IoCs
pid Process 5016 userinit.exe 180 system.exe 2592 system.exe 2520 system.exe 2804 system.exe 4444 system.exe 4164 system.exe 2920 system.exe 2160 system.exe 4868 system.exe 864 system.exe 1696 system.exe 1240 system.exe 4960 system.exe 2868 system.exe 4708 system.exe 4536 system.exe 5068 system.exe 2296 system.exe 2836 system.exe 3344 system.exe 2620 system.exe 1520 system.exe 3628 system.exe 1148 system.exe 1592 system.exe 1832 system.exe 4040 system.exe 4492 system.exe 2344 system.exe 1972 system.exe 4164 system.exe 4976 system.exe 3624 system.exe 4228 system.exe 3632 system.exe 2156 system.exe 4284 system.exe 3888 system.exe 3468 system.exe 1656 system.exe 1380 system.exe 2080 system.exe 3932 system.exe 2000 system.exe 2668 system.exe 4560 system.exe 904 system.exe 1760 system.exe 1832 system.exe 4040 system.exe 1868 system.exe 3660 system.exe 1360 system.exe 2464 system.exe 4328 system.exe 404 system.exe 3492 system.exe 4792 system.exe 1032 system.exe 5064 system.exe 4876 system.exe 3288 system.exe 4540 system.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\userinit.exe 11720d8fce40b7fdd68adbd307fbaa99.exe File opened for modification C:\Windows\userinit.exe 11720d8fce40b7fdd68adbd307fbaa99.exe File created C:\Windows\kdcoms.dll userinit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 5016 userinit.exe 5016 userinit.exe 5016 userinit.exe 5016 userinit.exe 180 system.exe 180 system.exe 5016 userinit.exe 5016 userinit.exe 2592 system.exe 2592 system.exe 5016 userinit.exe 5016 userinit.exe 2520 system.exe 2520 system.exe 5016 userinit.exe 5016 userinit.exe 2804 system.exe 2804 system.exe 5016 userinit.exe 5016 userinit.exe 4444 system.exe 4444 system.exe 5016 userinit.exe 5016 userinit.exe 4164 system.exe 4164 system.exe 5016 userinit.exe 5016 userinit.exe 2920 system.exe 2920 system.exe 5016 userinit.exe 5016 userinit.exe 2160 system.exe 2160 system.exe 5016 userinit.exe 5016 userinit.exe 4868 system.exe 4868 system.exe 5016 userinit.exe 5016 userinit.exe 864 system.exe 864 system.exe 5016 userinit.exe 5016 userinit.exe 1696 system.exe 1696 system.exe 5016 userinit.exe 5016 userinit.exe 1240 system.exe 1240 system.exe 5016 userinit.exe 5016 userinit.exe 4960 system.exe 4960 system.exe 5016 userinit.exe 5016 userinit.exe 2868 system.exe 2868 system.exe 5016 userinit.exe 5016 userinit.exe 4708 system.exe 4708 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5016 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 5016 userinit.exe 5016 userinit.exe 180 system.exe 180 system.exe 2592 system.exe 2592 system.exe 2520 system.exe 2520 system.exe 2804 system.exe 2804 system.exe 4444 system.exe 4444 system.exe 4164 system.exe 4164 system.exe 2920 system.exe 2920 system.exe 2160 system.exe 2160 system.exe 4868 system.exe 4868 system.exe 864 system.exe 864 system.exe 1696 system.exe 1696 system.exe 1240 system.exe 1240 system.exe 4960 system.exe 4960 system.exe 2868 system.exe 2868 system.exe 4708 system.exe 4708 system.exe 4536 system.exe 4536 system.exe 5068 system.exe 5068 system.exe 2296 system.exe 2296 system.exe 2836 system.exe 2836 system.exe 3344 system.exe 3344 system.exe 2620 system.exe 2620 system.exe 1520 system.exe 1520 system.exe 3628 system.exe 3628 system.exe 1148 system.exe 1148 system.exe 1592 system.exe 1592 system.exe 1832 system.exe 1832 system.exe 4040 system.exe 4040 system.exe 4492 system.exe 4492 system.exe 2344 system.exe 2344 system.exe 1972 system.exe 1972 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 5016 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 95 PID 2284 wrote to memory of 5016 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 95 PID 2284 wrote to memory of 5016 2284 11720d8fce40b7fdd68adbd307fbaa99.exe 95 PID 5016 wrote to memory of 180 5016 userinit.exe 96 PID 5016 wrote to memory of 180 5016 userinit.exe 96 PID 5016 wrote to memory of 180 5016 userinit.exe 96 PID 5016 wrote to memory of 2592 5016 userinit.exe 97 PID 5016 wrote to memory of 2592 5016 userinit.exe 97 PID 5016 wrote to memory of 2592 5016 userinit.exe 97 PID 5016 wrote to memory of 2520 5016 userinit.exe 98 PID 5016 wrote to memory of 2520 5016 userinit.exe 98 PID 5016 wrote to memory of 2520 5016 userinit.exe 98 PID 5016 wrote to memory of 2804 5016 userinit.exe 99 PID 5016 wrote to memory of 2804 5016 userinit.exe 99 PID 5016 wrote to memory of 2804 5016 userinit.exe 99 PID 5016 wrote to memory of 4444 5016 userinit.exe 100 PID 5016 wrote to memory of 4444 5016 userinit.exe 100 PID 5016 wrote to memory of 4444 5016 userinit.exe 100 PID 5016 wrote to memory of 4164 5016 userinit.exe 101 PID 5016 wrote to memory of 4164 5016 userinit.exe 101 PID 5016 wrote to memory of 4164 5016 userinit.exe 101 PID 5016 wrote to memory of 2920 5016 userinit.exe 102 PID 5016 wrote to memory of 2920 5016 userinit.exe 102 PID 5016 wrote to memory of 2920 5016 userinit.exe 102 PID 5016 wrote to memory of 2160 5016 userinit.exe 103 PID 5016 wrote to memory of 2160 5016 userinit.exe 103 PID 5016 wrote to memory of 2160 5016 userinit.exe 103 PID 5016 wrote to memory of 4868 5016 userinit.exe 104 PID 5016 wrote to memory of 4868 5016 userinit.exe 104 PID 5016 wrote to memory of 4868 5016 userinit.exe 104 PID 5016 wrote to memory of 864 5016 userinit.exe 105 PID 5016 wrote to memory of 864 5016 userinit.exe 105 PID 5016 wrote to memory of 864 5016 userinit.exe 105 PID 5016 wrote to memory of 1696 5016 userinit.exe 107 PID 5016 wrote to memory of 1696 5016 userinit.exe 107 PID 5016 wrote to memory of 1696 5016 userinit.exe 107 PID 5016 wrote to memory of 1240 5016 userinit.exe 108 PID 5016 wrote to memory of 1240 5016 userinit.exe 108 PID 5016 wrote to memory of 1240 5016 userinit.exe 108 PID 5016 wrote to memory of 4960 5016 userinit.exe 109 PID 5016 wrote to memory of 4960 5016 userinit.exe 109 PID 5016 wrote to memory of 4960 5016 userinit.exe 109 PID 5016 wrote to memory of 2868 5016 userinit.exe 110 PID 5016 wrote to memory of 2868 5016 userinit.exe 110 PID 5016 wrote to memory of 2868 5016 userinit.exe 110 PID 5016 wrote to memory of 4708 5016 userinit.exe 111 PID 5016 wrote to memory of 4708 5016 userinit.exe 111 PID 5016 wrote to memory of 4708 5016 userinit.exe 111 PID 5016 wrote to memory of 4536 5016 userinit.exe 112 PID 5016 wrote to memory of 4536 5016 userinit.exe 112 PID 5016 wrote to memory of 4536 5016 userinit.exe 112 PID 5016 wrote to memory of 5068 5016 userinit.exe 113 PID 5016 wrote to memory of 5068 5016 userinit.exe 113 PID 5016 wrote to memory of 5068 5016 userinit.exe 113 PID 5016 wrote to memory of 2296 5016 userinit.exe 114 PID 5016 wrote to memory of 2296 5016 userinit.exe 114 PID 5016 wrote to memory of 2296 5016 userinit.exe 114 PID 5016 wrote to memory of 2836 5016 userinit.exe 115 PID 5016 wrote to memory of 2836 5016 userinit.exe 115 PID 5016 wrote to memory of 2836 5016 userinit.exe 115 PID 5016 wrote to memory of 3344 5016 userinit.exe 116 PID 5016 wrote to memory of 3344 5016 userinit.exe 116 PID 5016 wrote to memory of 3344 5016 userinit.exe 116 PID 5016 wrote to memory of 2620 5016 userinit.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\11720d8fce40b7fdd68adbd307fbaa99.exe"C:\Users\Admin\AppData\Local\Temp\11720d8fce40b7fdd68adbd307fbaa99.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:180
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4444
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4164
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2160
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4708
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4536
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3344
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1148
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4492
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2344
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4164
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4976
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4228
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3632
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2156
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4284
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3888
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3468
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1656
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1380
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2080
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3932
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2668
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4560
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:904
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1760
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1832
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4040
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3660
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1360
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2464
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4328
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:404
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3492
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4792
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1032
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:5064
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4876
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3288
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4540
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3924
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4168
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4828
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:5076
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1688
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4256
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3452
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4224
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2668
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2800
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2176
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4228
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2596
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1032
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4396
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2424
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3424
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:228
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1988
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4248
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4692
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD511720d8fce40b7fdd68adbd307fbaa99
SHA12df4acf6a19734a1cdfc78d65f2f22305d45c83e
SHA25644a127ca39b9d0c4fa44434007423e1ca86c9c35c81cbc98773046538dd04944
SHA512fdd3bf1c1cad36b385ba610a1d7ee844ed3369042d6b3502ada9861629f46d73fa9a798a401fb909ab2a36e2b16b010866e6fb50d3fc5a6e86b3ea6500643aef