Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe
-
Size
240KB
-
MD5
9931427e6ac4c7875613897669456c1b
-
SHA1
73f942f94dd25fe08570ca4c744cc9b5967766e0
-
SHA256
b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1
-
SHA512
eb99f672a10898bd6b121a584181d7222515a9264d8b7097d67b7fc8e4545cc0a1e0a7d9cd90db3d30219f579c307f26fdfffd6d30c6fbc286fec6a7e3223051
-
SSDEEP
3072:4I0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHpgczwfSZJqsXQnhFkEv:Ut5xoNthj0I2aR1zmYiHvwfSZ4sXCF
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 26 IoCs
pid Process 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 2536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe 1252 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe 596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe 588 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe 1536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe 844 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe 1152 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe 1672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe 1888 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe 1044 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe 704 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exe -
Loads dropped DLL 52 IoCs
pid Process 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 2536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe 2536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe 1252 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe 1252 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe 596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe 596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe 588 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe 588 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe 1536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe 1536 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe 844 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe 844 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe 1152 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe 1152 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe 1672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe 1672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe 1888 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe 1888 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe 1044 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe 1044 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe -
Adds Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe\"" b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe -
Modifies registry class 54 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = fa5edd2eed93e307 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2956 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 28 PID 2944 wrote to memory of 2956 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 28 PID 2944 wrote to memory of 2956 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 28 PID 2944 wrote to memory of 2956 2944 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe 28 PID 2956 wrote to memory of 2764 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 29 PID 2956 wrote to memory of 2764 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 29 PID 2956 wrote to memory of 2764 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 29 PID 2956 wrote to memory of 2764 2956 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe 29 PID 2764 wrote to memory of 2568 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 30 PID 2764 wrote to memory of 2568 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 30 PID 2764 wrote to memory of 2568 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 30 PID 2764 wrote to memory of 2568 2764 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe 30 PID 2568 wrote to memory of 2596 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 31 PID 2568 wrote to memory of 2596 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 31 PID 2568 wrote to memory of 2596 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 31 PID 2568 wrote to memory of 2596 2568 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe 31 PID 2596 wrote to memory of 2624 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 32 PID 2596 wrote to memory of 2624 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 32 PID 2596 wrote to memory of 2624 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 32 PID 2596 wrote to memory of 2624 2596 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe 32 PID 2624 wrote to memory of 2552 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 33 PID 2624 wrote to memory of 2552 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 33 PID 2624 wrote to memory of 2552 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 33 PID 2624 wrote to memory of 2552 2624 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe 33 PID 2552 wrote to memory of 2512 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 34 PID 2552 wrote to memory of 2512 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 34 PID 2552 wrote to memory of 2512 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 34 PID 2552 wrote to memory of 2512 2552 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe 34 PID 2512 wrote to memory of 1680 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 35 PID 2512 wrote to memory of 1680 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 35 PID 2512 wrote to memory of 1680 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 35 PID 2512 wrote to memory of 1680 2512 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe 35 PID 1680 wrote to memory of 2948 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 36 PID 1680 wrote to memory of 2948 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 36 PID 1680 wrote to memory of 2948 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 36 PID 1680 wrote to memory of 2948 1680 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe 36 PID 2948 wrote to memory of 2772 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 37 PID 2948 wrote to memory of 2772 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 37 PID 2948 wrote to memory of 2772 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 37 PID 2948 wrote to memory of 2772 2948 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe 37 PID 2772 wrote to memory of 2672 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 38 PID 2772 wrote to memory of 2672 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 38 PID 2772 wrote to memory of 2672 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 38 PID 2772 wrote to memory of 2672 2772 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe 38 PID 2672 wrote to memory of 2692 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 39 PID 2672 wrote to memory of 2692 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 39 PID 2672 wrote to memory of 2692 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 39 PID 2672 wrote to memory of 2692 2672 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe 39 PID 2692 wrote to memory of 2384 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 40 PID 2692 wrote to memory of 2384 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 40 PID 2692 wrote to memory of 2384 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 40 PID 2692 wrote to memory of 2384 2692 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe 40 PID 2384 wrote to memory of 1200 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 41 PID 2384 wrote to memory of 1200 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 41 PID 2384 wrote to memory of 1200 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 41 PID 2384 wrote to memory of 1200 2384 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe 41 PID 1200 wrote to memory of 2084 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 42 PID 1200 wrote to memory of 2084 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 42 PID 1200 wrote to memory of 2084 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 42 PID 1200 wrote to memory of 2084 1200 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe 42 PID 2084 wrote to memory of 2536 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 43 PID 2084 wrote to memory of 2536 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 43 PID 2084 wrote to memory of 2536 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 43 PID 2084 wrote to memory of 2536 2084 b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe"C:\Users\Admin\AppData\Local\Temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202a.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202b.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202c.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202d.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202e.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202f.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202g.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202h.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202i.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202j.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202k.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202l.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202n.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202o.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:2536 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202p.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1252 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202q.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:596 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202r.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:588 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202s.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1536 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202t.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:844 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202u.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1152 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202v.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1672 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202w.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1888 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202x.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1044 -
\??\c:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exec:\users\admin\appdata\local\temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202y.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202.exe
Filesize240KB
MD554d5852c1ff5441250ebdcea0771fc78
SHA1f085b59afe3a3acb24943e13503092034798efb9
SHA256fa637cdb84a8f3a3cd5980441042267015c18cf4e40ba113511163051a23990e
SHA512869dd5ec91fd57c698ec07a79996b1e092be19a9129163024e5924e9e6ef7702354d34f8d02dc9e8d4d68cadc720811ac6b3361d99ca74f4eaa9ff90646918e1
-
\Users\Admin\AppData\Local\Temp\b9e86b772e480e8388389df79bcccd3f3806abca2550a605d0f92547c1b0b1a1_3202m.exe
Filesize240KB
MD5dfce58ab2c8bee432373229dfce15319
SHA1d805e0d9fcc9c566a005b6c0e1cfc92c3050d105
SHA2568a69a97b20c23e3191512e75fd5c3c812db431c7730311aa6768a240cb243792
SHA5122da1eaf49d104547b71f4ead50047449dd9c3803a52de292332edfacd580fbb783e6290ed6516b2f1079101d99eafbc912612406bb96fba5b8cf18fbbd9381ff