Malware Analysis Report

2025-08-05 19:38

Sample ID 240229-pqt2yshd67
Target ae85c7fc08d0010351e65e6f9d07f989
SHA256 27a687210fd76174f5adc615e7ff89247a9ec5fbc510d8721d51d6810ca21679
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

27a687210fd76174f5adc615e7ff89247a9ec5fbc510d8721d51d6810ca21679

Threat Level: Known bad

The file ae85c7fc08d0010351e65e6f9d07f989 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Sality

UAC bypass

Windows security bypass

UPX packed file

Executes dropped EXE

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-29 12:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-29 12:32

Reported

2024-02-29 12:35

Platform

win7-20240221-en

Max time kernel

136s

Max time network

137s

Command Line

C:\Windows\Explorer.EXE

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 2508 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhost.exe
PID 2508 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\Dwm.exe
PID 2508 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe

"C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe"

Network

N/A

Files

memory/2508-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2508-1-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/1120-5-0x00000000002C0000-0x00000000002C2000-memory.dmp

memory/2508-4-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-3-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-8-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-11-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-12-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-15-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2508-18-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2508-16-0x00000000041B0000-0x00000000041B1000-memory.dmp

memory/2508-20-0x00000000041B0000-0x00000000041B1000-memory.dmp

memory/2508-21-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-22-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-23-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-24-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-25-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-31-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-32-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-33-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-35-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-36-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-37-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-39-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-42-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-43-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-47-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-50-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-51-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2508-53-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-55-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-57-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-59-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-66-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-68-0x0000000001C80000-0x0000000002D0E000-memory.dmp

memory/2508-70-0x0000000001C80000-0x0000000002D0E000-memory.dmp

C:\tsnty.exe

MD5 237b831e8e7e469ffcbcc751333f72a8
SHA1 6b3c1650a4e2e119d78c5a72a333177cf3c3a4c8
SHA256 5aae8eab2ee5292c7f7421aa891370f953d9f18a60617165a521e9532e66fdb5
SHA512 c7624f0a25a1d50330795b381f814c5eb9c5d46818a4a269c40adfe1b96217be15412d87855deb3e4fb4d20083e4a9099c6aa40368bd8fbf1983eb12af180322

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-29 12:32

Reported

2024-02-29 12:35

Platform

win10v2004-20240226-en

Max time kernel

128s

Max time network

153s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4868 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\dwm.exe
PID 4868 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\sihost.exe
PID 4868 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhostw.exe
PID 4868 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 4868 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\DllHost.exe
PID 4868 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4868 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4868 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4868 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\dwm.exe
PID 4868 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\sihost.exe
PID 4868 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhostw.exe
PID 4868 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 4868 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\DllHost.exe
PID 4868 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4868 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4868 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4868 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4868 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4868 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\System32\RuntimeBroker.exe
PID 4868 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\fontdrvhost.exe
PID 4868 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\dwm.exe
PID 4868 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\sihost.exe
PID 4868 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\taskhostw.exe
PID 4868 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\Explorer.EXE
PID 4868 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\svchost.exe
PID 4868 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\system32\DllHost.exe
PID 4868 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5612 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5364 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3364 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3252 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2244 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff9732e2e98,0x7ff9732e2ea4,0x7ff9732e2eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe

"C:\Users\Admin\AppData\Local\Temp\ae85c7fc08d0010351e65e6f9d07f989.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 177.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
IE 209.85.202.95:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 95.202.85.209.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

memory/4868-0-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4868-2-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-4-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-5-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-7-0x0000000000750000-0x0000000000752000-memory.dmp

memory/4868-8-0x0000000004230000-0x0000000004231000-memory.dmp

memory/4868-9-0x0000000000750000-0x0000000000752000-memory.dmp

memory/4868-6-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-10-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-11-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-12-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-13-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-14-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-15-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-16-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-17-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-18-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-19-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-21-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-22-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-23-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-25-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-26-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-28-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-31-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-33-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-35-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-37-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-39-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-41-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-43-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-44-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-45-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-48-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-53-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-54-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-56-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-58-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-60-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-62-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-64-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-66-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-67-0x0000000002300000-0x000000000338E000-memory.dmp

memory/4868-68-0x0000000000750000-0x0000000000752000-memory.dmp

memory/4868-69-0x0000000002300000-0x000000000338E000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 b6ca3fb4e640c09b9c3efd7a6ae0de41
SHA1 3296e8aee6236ab4554a99045d92adabfa876949
SHA256 db36290c4e502fcf4e24503b36047ba408a1b4b7e30aa865f99cd9deeddd908a
SHA512 b60ffc9811aeb1e627c8b6f828c44085034b38da2d1d18e22ac7c465d8531fbd4ad6bc2a8c2df3b525bab8f0753ab3363b386bc82ecb6cfd17046c4fadc47965

C:\jmpo.exe

MD5 f81121cb52155d60df40644af0b15d7c
SHA1 f81546e7e42732b10df50edfcfcc9941e9c33d7b
SHA256 d37acfeed2f28375b8f7a9eb88da7d551ab9fbbc5be389618445dae858ac13cf
SHA512 ea0a349926bb6ab48ab3bcdd0c28f92cf9a54d7ef4af341ac9c9414f2183d51595f086218fa1eef383b97282c71f20922ea0da6dc256db020fdeebcb4aef384e