Analysis
-
max time kernel
22s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bd2f6cdefbe68f19ca2c1ef51ef123b.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bd2f6cdefbe68f19ca2c1ef51ef123b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7bd2f6cdefbe68f19ca2c1ef51ef123b.exe
-
Size
366KB
-
MD5
7bd2f6cdefbe68f19ca2c1ef51ef123b
-
SHA1
5aaaea86e6c8c293a8b43608fe78c4cdf12d1fd8
-
SHA256
6544118830e6ff6143dad5f2211b41497270f109232437512bb66626c8b96af0
-
SHA512
e11859897660ce96314e4f6924c66db74693c4232f2a04b06aa386103297217ea84760b90fed455500581ae5c5bd26fe044d3453ea31bfdc497d8c60fc953100
-
SSDEEP
6144:Nd8tdJzSxgZkAy4zN7fJjBSAuoYxdbeomzVQUgSRBWSwvP6bQ7yMP+DE827NXN:N44ajyCfJN+oYxBez5QU1u6b7MP+Dd2H
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2808 msqpbeb.exe 2712 mssbsav.exe 2912 msouqxa.exe 1888 msxqrhj.exe 2440 msdiftq.exe 2052 msjmdgy.exe 780 msjddkg.exe 384 msslisl.exe 2300 msaqtdx.exe 908 mswfaji.exe 2024 msyxgub.exe 2812 mswqseh.exe 2596 msngaea.exe 2708 msqyihu.exe 2588 msvpiok.exe 2636 msravfh.exe 2832 msbbqto.exe 2664 msohfom.exe 2956 mskecic.exe 1732 msvfepp.exe 1472 msvidhe.exe 2192 mssijvv.exe 2188 msfihpm.exe 1764 mskwwgg.exe 2172 mstmyfb.exe 1164 msjdwec.exe 2176 mssignj.exe 1828 msdvvff.exe 1468 msgqmgx.exe 2468 msvcyid.exe 2180 msmjhni.exe 2204 msyisul.exe 2116 mscdyga.exe 684 msjwsay.exe 860 msdasvn.exe 3008 mssytdy.exe 1824 msqngkc.exe 1204 msqaxey.exe 600 mslrdpj.exe 800 mstihpm.exe 2460 mswhgxb.exe 1832 msemjww.exe 1312 mselhxl.exe 1592 mswlepv.exe 568 msehbfa.exe 3004 msxkgqp.exe 1748 msscuyt.exe 2112 msmcxgb.exe 1668 mssxqwo.exe 1600 msyfisu.exe 284 msldxgt.exe 1448 msnbwhd.exe 1880 msqxqtk.exe 2740 msgupxv.exe 2748 msveybr.exe 2996 mswickg.exe 2752 mslolrj.exe 2612 mspnkss.exe 2092 msnojqj.exe 2592 msrvrbc.exe 2660 msfkcgx.exe 2640 msrfflk.exe 2972 mscbbmg.exe 2936 msyhdoo.exe -
Loads dropped DLL 64 IoCs
pid Process 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 2808 msqpbeb.exe 2808 msqpbeb.exe 2712 mssbsav.exe 2712 mssbsav.exe 2912 msouqxa.exe 2912 msouqxa.exe 1888 msxqrhj.exe 1888 msxqrhj.exe 2440 msdiftq.exe 2440 msdiftq.exe 2052 msjmdgy.exe 2052 msjmdgy.exe 780 msjddkg.exe 780 msjddkg.exe 384 msslisl.exe 384 msslisl.exe 2300 msaqtdx.exe 2300 msaqtdx.exe 908 mswfaji.exe 908 mswfaji.exe 2024 msyxgub.exe 2024 msyxgub.exe 2812 mswqseh.exe 2812 mswqseh.exe 2596 msngaea.exe 2596 msngaea.exe 2708 msqyihu.exe 2708 msqyihu.exe 2588 msvpiok.exe 2588 msvpiok.exe 2636 msravfh.exe 2636 msravfh.exe 2832 msbbqto.exe 2832 msbbqto.exe 2664 msohfom.exe 2664 msohfom.exe 2956 mskecic.exe 2956 mskecic.exe 1732 msvfepp.exe 1732 msvfepp.exe 1472 msvidhe.exe 1472 msvidhe.exe 2192 mssijvv.exe 2192 mssijvv.exe 2188 msfihpm.exe 2188 msfihpm.exe 1764 mskwwgg.exe 1764 mskwwgg.exe 2172 mstmyfb.exe 2172 mstmyfb.exe 1164 msjdwec.exe 1164 msjdwec.exe 2176 mssignj.exe 2176 mssignj.exe 1828 msdvvff.exe 1828 msdvvff.exe 1468 msgqmgx.exe 1468 msgqmgx.exe 2468 msvcyid.exe 2468 msvcyid.exe 2180 msmjhni.exe 2180 msmjhni.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 msocbnp.exe File opened for modification \??\PhysicalDrive0 msbvxmk.exe File opened for modification \??\PhysicalDrive0 msyhycv.exe File opened for modification \??\PhysicalDrive0 msxllut.exe File opened for modification \??\PhysicalDrive0 msravfh.exe File opened for modification \??\PhysicalDrive0 mstgluu.exe File opened for modification \??\PhysicalDrive0 msbcgqn.exe File opened for modification \??\PhysicalDrive0 mspfepp.exe File opened for modification \??\PhysicalDrive0 msmfcnn.exe File opened for modification \??\PhysicalDrive0 msriovv.exe File opened for modification \??\PhysicalDrive0 mskoeib.exe File opened for modification \??\PhysicalDrive0 msmyall.exe File opened for modification \??\PhysicalDrive0 mspduvn.exe File opened for modification \??\PhysicalDrive0 msfjbyo.exe File opened for modification \??\PhysicalDrive0 msduwko.exe File opened for modification \??\PhysicalDrive0 mscvtyt.exe File opened for modification \??\PhysicalDrive0 mssebcs.exe File opened for modification \??\PhysicalDrive0 msdmlvw.exe File opened for modification \??\PhysicalDrive0 msqywdx.exe File opened for modification \??\PhysicalDrive0 mssijvv.exe File opened for modification \??\PhysicalDrive0 mssignj.exe File opened for modification \??\PhysicalDrive0 msucgvb.exe File opened for modification \??\PhysicalDrive0 msivumm.exe File opened for modification \??\PhysicalDrive0 msnbwhd.exe File opened for modification \??\PhysicalDrive0 msyljvx.exe File opened for modification \??\PhysicalDrive0 msfwsxq.exe File opened for modification \??\PhysicalDrive0 msfkfrg.exe File opened for modification \??\PhysicalDrive0 msipkrp.exe File opened for modification \??\PhysicalDrive0 msqtlog.exe File opened for modification \??\PhysicalDrive0 mshayll.exe File opened for modification \??\PhysicalDrive0 msslisl.exe File opened for modification \??\PhysicalDrive0 msrbvbw.exe File opened for modification \??\PhysicalDrive0 msehagw.exe File opened for modification \??\PhysicalDrive0 msfjaey.exe File opened for modification \??\PhysicalDrive0 mscjpav.exe File opened for modification \??\PhysicalDrive0 msqwouo.exe File opened for modification \??\PhysicalDrive0 msqbpqi.exe File opened for modification \??\PhysicalDrive0 msnupvs.exe File opened for modification \??\PhysicalDrive0 msngaea.exe File opened for modification \??\PhysicalDrive0 msjbert.exe File opened for modification \??\PhysicalDrive0 msrnjsr.exe File opened for modification \??\PhysicalDrive0 msqlgwf.exe File opened for modification \??\PhysicalDrive0 mskroyy.exe File opened for modification \??\PhysicalDrive0 msebqrn.exe File opened for modification \??\PhysicalDrive0 msvfyhh.exe File opened for modification \??\PhysicalDrive0 msupshk.exe File opened for modification \??\PhysicalDrive0 msbexhh.exe File opened for modification \??\PhysicalDrive0 msgnlvq.exe File opened for modification \??\PhysicalDrive0 msyfisu.exe File opened for modification \??\PhysicalDrive0 msmixea.exe File opened for modification \??\PhysicalDrive0 msgwsby.exe File opened for modification \??\PhysicalDrive0 msngiwy.exe File opened for modification \??\PhysicalDrive0 msqgfin.exe File opened for modification \??\PhysicalDrive0 mssvwge.exe File opened for modification \??\PhysicalDrive0 mspnkss.exe File opened for modification \??\PhysicalDrive0 msluqbw.exe File opened for modification \??\PhysicalDrive0 msqbdmn.exe File opened for modification \??\PhysicalDrive0 msdasvn.exe File opened for modification \??\PhysicalDrive0 mspaxrn.exe File opened for modification \??\PhysicalDrive0 mscttdc.exe File opened for modification \??\PhysicalDrive0 msmvmmf.exe File opened for modification \??\PhysicalDrive0 msattgg.exe File opened for modification \??\PhysicalDrive0 msgvsdb.exe File opened for modification \??\PhysicalDrive0 msmgfmj.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msfjbyo.exe msnpjmf.exe File opened for modification C:\Windows\SysWOW64\mshtowu.exe mscjfoi.exe File created C:\Windows\SysWOW64\msspltm.exe mskeakg.exe File opened for modification C:\Windows\SysWOW64\msvpiok.exe msqyihu.exe File opened for modification C:\Windows\SysWOW64\mshqnuq.exe msywtxr.exe File opened for modification C:\Windows\SysWOW64\msjnvii.exe mspduvn.exe File created C:\Windows\SysWOW64\mshyudc.exe mssooxu.exe File opened for modification C:\Windows\SysWOW64\msxqrhj.exe msouqxa.exe File created C:\Windows\SysWOW64\msngaea.exe mswqseh.exe File opened for modification C:\Windows\SysWOW64\msdbcnm.exe msjtucx.exe File opened for modification C:\Windows\SysWOW64\msymlwt.exe msjaamj.exe File opened for modification C:\Windows\SysWOW64\msvfyhh.exe mscuvgk.exe File created C:\Windows\SysWOW64\msmyuxs.exe mscfkuv.exe File created C:\Windows\SysWOW64\msuhhtv.exe msygiuw.exe File opened for modification C:\Windows\SysWOW64\msxkgqp.exe msehbfa.exe File opened for modification C:\Windows\SysWOW64\msiujvl.exe mshsmtm.exe File opened for modification C:\Windows\SysWOW64\msseajh.exe msiujvl.exe File created C:\Windows\SysWOW64\msuncsp.exe msluqbw.exe File opened for modification C:\Windows\SysWOW64\msbwblm.exe mstmjtu.exe File opened for modification C:\Windows\SysWOW64\msclfjh.exe msnioej.exe File created C:\Windows\SysWOW64\mswooxx.exe msfekrn.exe File opened for modification C:\Windows\SysWOW64\msejrln.exe msiyymn.exe File created C:\Windows\SysWOW64\msoopcb.exe msyurbb.exe File opened for modification C:\Windows\SysWOW64\mscuvgk.exe mssvwge.exe File created C:\Windows\SysWOW64\msqwouo.exe msvbajk.exe File created C:\Windows\SysWOW64\msoauvk.exe msbmnek.exe File created C:\Windows\SysWOW64\mspyweb.exe msuqovr.exe File created C:\Windows\SysWOW64\mswlepv.exe mselhxl.exe File created C:\Windows\SysWOW64\msgwsby.exe msghfni.exe File created C:\Windows\SysWOW64\msvxpyt.exe msowpca.exe File created C:\Windows\SysWOW64\msxlktr.exe mserlww.exe File created C:\Windows\SysWOW64\mstihpm.exe mslrdpj.exe File opened for modification C:\Windows\SysWOW64\msvokwu.exe msidcmo.exe File created C:\Windows\SysWOW64\msbhbea.exe mslheon.exe File opened for modification C:\Windows\SysWOW64\msclocd.exe mshyyjh.exe File opened for modification C:\Windows\SysWOW64\mslftwm.exe msjqmts.exe File opened for modification C:\Windows\SysWOW64\mscaalm.exe mshvrwu.exe File opened for modification C:\Windows\SysWOW64\msgipxa.exe msbhbea.exe File created C:\Windows\SysWOW64\msqaxey.exe msqngkc.exe File opened for modification C:\Windows\SysWOW64\msrvrbc.exe msnojqj.exe File created C:\Windows\SysWOW64\mscbbmg.exe msrfflk.exe File created C:\Windows\SysWOW64\msyhycv.exe msjkvvn.exe File created C:\Windows\SysWOW64\mswrgkd.exe msjbert.exe File created C:\Windows\SysWOW64\mswbxij.exe msyjfnl.exe File created C:\Windows\SysWOW64\msqegqq.exe msvokwu.exe File opened for modification C:\Windows\SysWOW64\msadyig.exe msebqrn.exe File opened for modification C:\Windows\SysWOW64\msyonya.exe mshyudc.exe File created C:\Windows\SysWOW64\msitmwu.exe msbshtw.exe File opened for modification C:\Windows\SysWOW64\msdiftq.exe msxqrhj.exe File created C:\Windows\SysWOW64\mslapcb.exe msadyig.exe File opened for modification C:\Windows\SysWOW64\msoypbb.exe mshruhj.exe File opened for modification C:\Windows\SysWOW64\msjggol.exe msvxpyt.exe File opened for modification C:\Windows\SysWOW64\msagxas.exe mssaalk.exe File opened for modification C:\Windows\SysWOW64\mscwbpq.exe msoypbb.exe File created C:\Windows\SysWOW64\mslrdpj.exe msqaxey.exe File opened for modification C:\Windows\SysWOW64\mstihpm.exe mslrdpj.exe File created C:\Windows\SysWOW64\mselhxl.exe msemjww.exe File opened for modification C:\Windows\SysWOW64\mspaxrn.exe msgwsby.exe File created C:\Windows\SysWOW64\msskjtw.exe msmgoek.exe File opened for modification C:\Windows\SysWOW64\mssggqm.exe mswooxx.exe File opened for modification C:\Windows\SysWOW64\msbshtw.exe mskcbhb.exe File created C:\Windows\SysWOW64\msqgfin.exe msytsdf.exe File created C:\Windows\SysWOW64\mshffhd.exe msedakl.exe File created C:\Windows\SysWOW64\mssaalk.exe msyhvyt.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msnpjmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mswkhss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msjnvii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mssignj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msrgxoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msqwouo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msaumrl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msqegqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msjxsas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msbwblm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msyhvyt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msrvrbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msbiiss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msjignm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key mscfkuv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msafycu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msmixea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msoxrws.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msphwhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mstmnyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mswwlni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msshocc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msvbajk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msspltm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msdgepr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msbgvxq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msxkgqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msgnlvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msqywdx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msouqxa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key mshqnuq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mskutef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msrvrbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mspayrt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msoauvk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msmfmdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msbwblm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msvpiok.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mssnxat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msfwxlk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msfvqab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mswickg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msghfni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mshiaqw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msoopcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msnielh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mselhxl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msjtucx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msiyxjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msuqoaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msclfjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msucgvb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mscbbmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msmjhni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ msseajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msowpca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msrvqdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key mslwmww.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key msctseb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msnielh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msjmdgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key mshiaqw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" msqlgwf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ mserlww.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2808 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 28 PID 1900 wrote to memory of 2808 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 28 PID 1900 wrote to memory of 2808 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 28 PID 1900 wrote to memory of 2808 1900 7bd2f6cdefbe68f19ca2c1ef51ef123b.exe 28 PID 2808 wrote to memory of 2712 2808 msqpbeb.exe 29 PID 2808 wrote to memory of 2712 2808 msqpbeb.exe 29 PID 2808 wrote to memory of 2712 2808 msqpbeb.exe 29 PID 2808 wrote to memory of 2712 2808 msqpbeb.exe 29 PID 2712 wrote to memory of 2912 2712 mssbsav.exe 30 PID 2712 wrote to memory of 2912 2712 mssbsav.exe 30 PID 2712 wrote to memory of 2912 2712 mssbsav.exe 30 PID 2712 wrote to memory of 2912 2712 mssbsav.exe 30 PID 2912 wrote to memory of 1888 2912 msouqxa.exe 31 PID 2912 wrote to memory of 1888 2912 msouqxa.exe 31 PID 2912 wrote to memory of 1888 2912 msouqxa.exe 31 PID 2912 wrote to memory of 1888 2912 msouqxa.exe 31 PID 1888 wrote to memory of 2440 1888 msxqrhj.exe 32 PID 1888 wrote to memory of 2440 1888 msxqrhj.exe 32 PID 1888 wrote to memory of 2440 1888 msxqrhj.exe 32 PID 1888 wrote to memory of 2440 1888 msxqrhj.exe 32 PID 2440 wrote to memory of 2052 2440 msdiftq.exe 33 PID 2440 wrote to memory of 2052 2440 msdiftq.exe 33 PID 2440 wrote to memory of 2052 2440 msdiftq.exe 33 PID 2440 wrote to memory of 2052 2440 msdiftq.exe 33 PID 2052 wrote to memory of 780 2052 msjmdgy.exe 34 PID 2052 wrote to memory of 780 2052 msjmdgy.exe 34 PID 2052 wrote to memory of 780 2052 msjmdgy.exe 34 PID 2052 wrote to memory of 780 2052 msjmdgy.exe 34 PID 780 wrote to memory of 384 780 msjddkg.exe 35 PID 780 wrote to memory of 384 780 msjddkg.exe 35 PID 780 wrote to memory of 384 780 msjddkg.exe 35 PID 780 wrote to memory of 384 780 msjddkg.exe 35 PID 384 wrote to memory of 2300 384 msslisl.exe 36 PID 384 wrote to memory of 2300 384 msslisl.exe 36 PID 384 wrote to memory of 2300 384 msslisl.exe 36 PID 384 wrote to memory of 2300 384 msslisl.exe 36 PID 2300 wrote to memory of 908 2300 msaqtdx.exe 37 PID 2300 wrote to memory of 908 2300 msaqtdx.exe 37 PID 2300 wrote to memory of 908 2300 msaqtdx.exe 37 PID 2300 wrote to memory of 908 2300 msaqtdx.exe 37 PID 908 wrote to memory of 2024 908 mswfaji.exe 38 PID 908 wrote to memory of 2024 908 mswfaji.exe 38 PID 908 wrote to memory of 2024 908 mswfaji.exe 38 PID 908 wrote to memory of 2024 908 mswfaji.exe 38 PID 2024 wrote to memory of 2812 2024 msyxgub.exe 39 PID 2024 wrote to memory of 2812 2024 msyxgub.exe 39 PID 2024 wrote to memory of 2812 2024 msyxgub.exe 39 PID 2024 wrote to memory of 2812 2024 msyxgub.exe 39 PID 2812 wrote to memory of 2596 2812 mswqseh.exe 40 PID 2812 wrote to memory of 2596 2812 mswqseh.exe 40 PID 2812 wrote to memory of 2596 2812 mswqseh.exe 40 PID 2812 wrote to memory of 2596 2812 mswqseh.exe 40 PID 2596 wrote to memory of 2708 2596 msngaea.exe 41 PID 2596 wrote to memory of 2708 2596 msngaea.exe 41 PID 2596 wrote to memory of 2708 2596 msngaea.exe 41 PID 2596 wrote to memory of 2708 2596 msngaea.exe 41 PID 2708 wrote to memory of 2588 2708 msqyihu.exe 42 PID 2708 wrote to memory of 2588 2708 msqyihu.exe 42 PID 2708 wrote to memory of 2588 2708 msqyihu.exe 42 PID 2708 wrote to memory of 2588 2708 msqyihu.exe 42 PID 2588 wrote to memory of 2636 2588 msvpiok.exe 43 PID 2588 wrote to memory of 2636 2588 msvpiok.exe 43 PID 2588 wrote to memory of 2636 2588 msvpiok.exe 43 PID 2588 wrote to memory of 2636 2588 msvpiok.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd2f6cdefbe68f19ca2c1ef51ef123b.exe"C:\Users\Admin\AppData\Local\Temp\7bd2f6cdefbe68f19ca2c1ef51ef123b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\msqpbeb.exeC:\Windows\system32\msqpbeb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\mssbsav.exeC:\Windows\system32\mssbsav.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\msouqxa.exeC:\Windows\system32\msouqxa.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\msxqrhj.exeC:\Windows\system32\msxqrhj.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\msdiftq.exeC:\Windows\system32\msdiftq.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\msjmdgy.exeC:\Windows\system32\msjmdgy.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\msjddkg.exeC:\Windows\system32\msjddkg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\msslisl.exeC:\Windows\system32\msslisl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\msaqtdx.exeC:\Windows\system32\msaqtdx.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\mswfaji.exeC:\Windows\system32\mswfaji.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\msyxgub.exeC:\Windows\system32\msyxgub.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\mswqseh.exeC:\Windows\system32\mswqseh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\msngaea.exeC:\Windows\system32\msngaea.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\msqyihu.exeC:\Windows\system32\msqyihu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\msvpiok.exeC:\Windows\system32\msvpiok.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\msravfh.exeC:\Windows\system32\msravfh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:2636 -
C:\Windows\SysWOW64\msbbqto.exeC:\Windows\system32\msbbqto.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Windows\SysWOW64\msohfom.exeC:\Windows\system32\msohfom.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Windows\SysWOW64\mskecic.exeC:\Windows\system32\mskecic.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Windows\SysWOW64\msvfepp.exeC:\Windows\system32\msvfepp.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Windows\SysWOW64\msvidhe.exeC:\Windows\system32\msvidhe.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Windows\SysWOW64\mssijvv.exeC:\Windows\system32\mssijvv.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:2192 -
C:\Windows\SysWOW64\msfihpm.exeC:\Windows\system32\msfihpm.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\mskwwgg.exeC:\Windows\system32\mskwwgg.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\mstmyfb.exeC:\Windows\system32\mstmyfb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\msjdwec.exeC:\Windows\system32\msjdwec.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Windows\SysWOW64\mssignj.exeC:\Windows\system32\mssignj.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2176 -
C:\Windows\SysWOW64\msdvvff.exeC:\Windows\system32\msdvvff.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Windows\SysWOW64\msgqmgx.exeC:\Windows\system32\msgqmgx.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\msvcyid.exeC:\Windows\system32\msvcyid.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Windows\SysWOW64\msmjhni.exeC:\Windows\system32\msmjhni.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2180 -
C:\Windows\SysWOW64\msyisul.exeC:\Windows\system32\msyisul.exe33⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\mscdyga.exeC:\Windows\system32\mscdyga.exe34⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\msjwsay.exeC:\Windows\system32\msjwsay.exe35⤵
- Executes dropped EXE
PID:684 -
C:\Windows\SysWOW64\msdasvn.exeC:\Windows\system32\msdasvn.exe36⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:860 -
C:\Windows\SysWOW64\mssytdy.exeC:\Windows\system32\mssytdy.exe37⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\msqngkc.exeC:\Windows\system32\msqngkc.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1824 -
C:\Windows\SysWOW64\msqaxey.exeC:\Windows\system32\msqaxey.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\mslrdpj.exeC:\Windows\system32\mslrdpj.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:600 -
C:\Windows\SysWOW64\mstihpm.exeC:\Windows\system32\mstihpm.exe41⤵
- Executes dropped EXE
PID:800 -
C:\Windows\SysWOW64\mswhgxb.exeC:\Windows\system32\mswhgxb.exe42⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\msemjww.exeC:\Windows\system32\msemjww.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\mselhxl.exeC:\Windows\system32\mselhxl.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1312 -
C:\Windows\SysWOW64\mswlepv.exeC:\Windows\system32\mswlepv.exe45⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\msehbfa.exeC:\Windows\system32\msehbfa.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:568 -
C:\Windows\SysWOW64\msxkgqp.exeC:\Windows\system32\msxkgqp.exe47⤵
- Executes dropped EXE
- Modifies registry class
PID:3004 -
C:\Windows\SysWOW64\msscuyt.exeC:\Windows\system32\msscuyt.exe48⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\SysWOW64\msmcxgb.exeC:\Windows\system32\msmcxgb.exe49⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\mssxqwo.exeC:\Windows\system32\mssxqwo.exe50⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\msyfisu.exeC:\Windows\system32\msyfisu.exe51⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1600 -
C:\Windows\SysWOW64\msldxgt.exeC:\Windows\system32\msldxgt.exe52⤵
- Executes dropped EXE
PID:284 -
C:\Windows\SysWOW64\msnbwhd.exeC:\Windows\system32\msnbwhd.exe53⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1448 -
C:\Windows\SysWOW64\msqxqtk.exeC:\Windows\system32\msqxqtk.exe54⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\msgupxv.exeC:\Windows\system32\msgupxv.exe55⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\SysWOW64\msveybr.exeC:\Windows\system32\msveybr.exe56⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\SysWOW64\mswickg.exeC:\Windows\system32\mswickg.exe57⤵
- Executes dropped EXE
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\mslolrj.exeC:\Windows\system32\mslolrj.exe58⤵
- Executes dropped EXE
PID:2752 -
C:\Windows\SysWOW64\mspnkss.exeC:\Windows\system32\mspnkss.exe59⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2612 -
C:\Windows\SysWOW64\msnojqj.exeC:\Windows\system32\msnojqj.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2092 -
C:\Windows\SysWOW64\msrvrbc.exeC:\Windows\system32\msrvrbc.exe61⤵
- Executes dropped EXE
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\msfkcgx.exeC:\Windows\system32\msfkcgx.exe62⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\msrfflk.exeC:\Windows\system32\msrfflk.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\mscbbmg.exeC:\Windows\system32\mscbbmg.exe64⤵
- Executes dropped EXE
- Modifies registry class
PID:2972 -
C:\Windows\SysWOW64\msyhdoo.exeC:\Windows\system32\msyhdoo.exe65⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\mslvqtl.exeC:\Windows\system32\mslvqtl.exe66⤵PID:1776
-
C:\Windows\SysWOW64\msmfcnn.exeC:\Windows\system32\msmfcnn.exe67⤵
- Writes to the Master Boot Record (MBR)
PID:1564 -
C:\Windows\SysWOW64\msrbvbw.exeC:\Windows\system32\msrbvbw.exe68⤵
- Writes to the Master Boot Record (MBR)
PID:1436 -
C:\Windows\SysWOW64\msrbvfa.exeC:\Windows\system32\msrbvfa.exe69⤵PID:2576
-
C:\Windows\SysWOW64\mstulqm.exeC:\Windows\system32\mstulqm.exe70⤵PID:2000
-
C:\Windows\SysWOW64\msfvqab.exeC:\Windows\system32\msfvqab.exe71⤵
- Modifies registry class
PID:1208 -
C:\Windows\SysWOW64\msdrjok.exeC:\Windows\system32\msdrjok.exe72⤵PID:2084
-
C:\Windows\SysWOW64\msftsda.exeC:\Windows\system32\msftsda.exe73⤵PID:2044
-
C:\Windows\SysWOW64\msgnfmi.exeC:\Windows\system32\msgnfmi.exe74⤵PID:2068
-
C:\Windows\SysWOW64\msdyygg.exeC:\Windows\system32\msdyygg.exe75⤵PID:336
-
C:\Windows\SysWOW64\msbgvxq.exeC:\Windows\system32\msbgvxq.exe76⤵
- Modifies registry class
PID:584 -
C:\Windows\SysWOW64\mskxude.exeC:\Windows\system32\mskxude.exe77⤵PID:2980
-
C:\Windows\SysWOW64\msbkchc.exeC:\Windows\system32\msbkchc.exe78⤵PID:1140
-
C:\Windows\SysWOW64\msxqmsq.exeC:\Windows\system32\msxqmsq.exe79⤵PID:2348
-
C:\Windows\SysWOW64\mswwlni.exeC:\Windows\system32\mswwlni.exe80⤵
- Modifies registry class
PID:2200 -
C:\Windows\SysWOW64\msbexhh.exeC:\Windows\system32\msbexhh.exe81⤵
- Writes to the Master Boot Record (MBR)
PID:1920 -
C:\Windows\SysWOW64\msyeuby.exeC:\Windows\system32\msyeuby.exe82⤵PID:816
-
C:\Windows\SysWOW64\msibrdm.exeC:\Windows\system32\msibrdm.exe83⤵PID:1032
-
C:\Windows\SysWOW64\msmixea.exeC:\Windows\system32\msmixea.exe84⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\msnioej.exeC:\Windows\system32\msnioej.exe85⤵
- Drops file in System32 directory
PID:1636 -
C:\Windows\SysWOW64\msclfjh.exeC:\Windows\system32\msclfjh.exe86⤵
- Modifies registry class
PID:2392 -
C:\Windows\SysWOW64\msejafy.exeC:\Windows\system32\msejafy.exe87⤵PID:2120
-
C:\Windows\SysWOW64\mshsmtm.exeC:\Windows\system32\mshsmtm.exe88⤵
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\msiujvl.exeC:\Windows\system32\msiujvl.exe89⤵
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\msseajh.exeC:\Windows\system32\msseajh.exe90⤵
- Modifies registry class
PID:2820 -
C:\Windows\SysWOW64\msluqbw.exeC:\Windows\system32\msluqbw.exe91⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:2700 -
C:\Windows\SysWOW64\msuncsp.exeC:\Windows\system32\msuncsp.exe92⤵PID:2356
-
C:\Windows\SysWOW64\mshulrl.exeC:\Windows\system32\mshulrl.exe93⤵PID:2632
-
C:\Windows\SysWOW64\mspjjqm.exeC:\Windows\system32\mspjjqm.exe94⤵PID:1996
-
C:\Windows\SysWOW64\msjkvvn.exeC:\Windows\system32\msjkvvn.exe95⤵
- Drops file in System32 directory
PID:2600 -
C:\Windows\SysWOW64\msyhycv.exeC:\Windows\system32\msyhycv.exe96⤵
- Writes to the Master Boot Record (MBR)
PID:2908 -
C:\Windows\SysWOW64\msuilmr.exeC:\Windows\system32\msuilmr.exe97⤵PID:2896
-
C:\Windows\SysWOW64\msubruo.exeC:\Windows\system32\msubruo.exe98⤵PID:1224
-
C:\Windows\SysWOW64\msmvkce.exeC:\Windows\system32\msmvkce.exe99⤵PID:2492
-
C:\Windows\SysWOW64\mssnxat.exeC:\Windows\system32\mssnxat.exe100⤵
- Modifies registry class
PID:1692 -
C:\Windows\SysWOW64\mshngiv.exeC:\Windows\system32\mshngiv.exe101⤵PID:2564
-
C:\Windows\SysWOW64\mswvprk.exeC:\Windows\system32\mswvprk.exe102⤵PID:280
-
C:\Windows\SysWOW64\msbvntl.exeC:\Windows\system32\msbvntl.exe103⤵PID:1484
-
C:\Windows\SysWOW64\msrliog.exeC:\Windows\system32\msrliog.exe104⤵PID:1680
-
C:\Windows\SysWOW64\msfjaey.exeC:\Windows\system32\msfjaey.exe105⤵
- Writes to the Master Boot Record (MBR)
PID:2232 -
C:\Windows\SysWOW64\mscxoup.exeC:\Windows\system32\mscxoup.exe106⤵PID:328
-
C:\Windows\SysWOW64\msrfwcu.exeC:\Windows\system32\msrfwcu.exe107⤵PID:576
-
C:\Windows\SysWOW64\msiomoc.exeC:\Windows\system32\msiomoc.exe108⤵PID:1316
-
C:\Windows\SysWOW64\mscvtyt.exeC:\Windows\system32\mscvtyt.exe109⤵
- Writes to the Master Boot Record (MBR)
PID:2240 -
C:\Windows\SysWOW64\mscskro.exeC:\Windows\system32\mscskro.exe110⤵PID:1124
-
C:\Windows\SysWOW64\msmuxhn.exeC:\Windows\system32\msmuxhn.exe111⤵PID:2400
-
C:\Windows\SysWOW64\msfldfu.exeC:\Windows\system32\msfldfu.exe112⤵PID:2152
-
C:\Windows\SysWOW64\mssphqh.exeC:\Windows\system32\mssphqh.exe113⤵PID:2404
-
C:\Windows\SysWOW64\mspioxr.exeC:\Windows\system32\mspioxr.exe114⤵PID:2324
-
C:\Windows\SysWOW64\mssebcs.exeC:\Windows\system32\mssebcs.exe115⤵
- Writes to the Master Boot Record (MBR)
PID:1480 -
C:\Windows\SysWOW64\msqotrg.exeC:\Windows\system32\msqotrg.exe116⤵PID:1520
-
C:\Windows\SysWOW64\msprcnk.exeC:\Windows\system32\msprcnk.exe117⤵PID:2780
-
C:\Windows\SysWOW64\msmvnqk.exeC:\Windows\system32\msmvnqk.exe118⤵PID:2696
-
C:\Windows\SysWOW64\msqtlog.exeC:\Windows\system32\msqtlog.exe119⤵
- Writes to the Master Boot Record (MBR)
PID:2624 -
C:\Windows\SysWOW64\msruotn.exeC:\Windows\system32\msruotn.exe120⤵PID:1988
-
C:\Windows\SysWOW64\msifrwr.exeC:\Windows\system32\msifrwr.exe121⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-