Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 16:10
Behavioral task
behavioral1
Sample
bc3c060e5bc498d60bf64880100e5b7f.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc3c060e5bc498d60bf64880100e5b7f.exe
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
bc3c060e5bc498d60bf64880100e5b7f.exe
-
Size
50KB
-
MD5
bc3c060e5bc498d60bf64880100e5b7f
-
SHA1
028198dae630b2c348c4e184945fce677e4fe4b4
-
SHA256
54e34f37082532c4acc38df72191292be7fc04621a258f2712b21375fa2cfdc4
-
SHA512
f775de90b0e523b5adc0b8f10317d7f25bc597a588cdf09afe88d56fef4cdb941bbde24dcbc9383e64206d60c8db558cb6c594b1f537a9a5f728211ee004b6be
-
SSDEEP
1536:oHdZYzwsjwvtV3NvcqhEzfXzeBU1aps6QfqBMb+8:oHEzwmw79viz/zeBU1aps6Q+MK8
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5024 icf.exe 4780 icf.exe 3840 icf.exe 4744 icf.exe 1240 icf.exe 3316 icf.exe 2528 icf.exe 3288 icf.exe 848 icf.exe 4876 icf.exe 4604 icf.exe 2252 icf.exe 2864 icf.exe 3464 icf.exe 1624 icf.exe 2096 icf.exe 5112 icf.exe 3608 icf.exe 4388 icf.exe 2960 icf.exe 3764 icf.exe 3224 icf.exe 1676 icf.exe 2288 icf.exe 3740 icf.exe 4476 icf.exe 3308 icf.exe 1072 icf.exe 2820 icf.exe 2328 icf.exe 4036 icf.exe 2204 icf.exe 4208 icf.exe 8 icf.exe 2388 icf.exe 2012 icf.exe 5056 icf.exe 3120 icf.exe 3604 icf.exe 1436 icf.exe 2464 icf.exe 1448 icf.exe 1916 icf.exe 4256 icf.exe 3280 icf.exe 1720 icf.exe 3260 icf.exe 2380 icf.exe 5060 icf.exe 4004 icf.exe 1228 icf.exe 3480 icf.exe 4064 icf.exe 316 icf.exe 3640 icf.exe 4824 icf.exe 1420 icf.exe 640 icf.exe 2412 icf.exe 1592 icf.exe 4336 icf.exe 2292 icf.exe 2172 icf.exe 1380 icf.exe -
resource yara_rule behavioral2/memory/3336-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x000200000001f656-3.dat upx behavioral2/memory/3840-8-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3336-16-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2252-18-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4664-70-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/5164-71-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/5476-72-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/6540-73-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/6804-74-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/7644-75-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/9244-108-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1544-109-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/10432-110-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/10520-111-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/11376-134-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/12164-145-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/12544-146-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3336-152-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/5024-158-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\icf = "c:\\windows\\system32\\icf.exe" icf.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\5242883.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\11993091.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\4718595.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\6422531.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\9043971.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\4390915.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\6094851.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\10354691.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\4718595.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\5570563.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\5570563.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\4390915.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\6029315.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\6946819.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\6160387.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\6946819.bat icf.exe File created \??\c:\windows\SysWOW64\1835011.bat icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File created \??\c:\windows\SysWOW64\icf.exe icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe File opened for modification \??\c:\windows\SysWOW64\1835011.bat icf.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 8672 8548 WerFault.exe 359 8388 8572 WerFault.exe 360 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 5024 3336 bc3c060e5bc498d60bf64880100e5b7f.exe 88 PID 3336 wrote to memory of 5024 3336 bc3c060e5bc498d60bf64880100e5b7f.exe 88 PID 3336 wrote to memory of 5024 3336 bc3c060e5bc498d60bf64880100e5b7f.exe 88 PID 5024 wrote to memory of 4780 5024 icf.exe 89 PID 5024 wrote to memory of 4780 5024 icf.exe 89 PID 5024 wrote to memory of 4780 5024 icf.exe 89 PID 4780 wrote to memory of 3840 4780 icf.exe 90 PID 4780 wrote to memory of 3840 4780 icf.exe 90 PID 4780 wrote to memory of 3840 4780 icf.exe 90 PID 3840 wrote to memory of 4744 3840 icf.exe 91 PID 3840 wrote to memory of 4744 3840 icf.exe 91 PID 3840 wrote to memory of 4744 3840 icf.exe 91 PID 4744 wrote to memory of 1240 4744 icf.exe 92 PID 4744 wrote to memory of 1240 4744 icf.exe 92 PID 4744 wrote to memory of 1240 4744 icf.exe 92 PID 1240 wrote to memory of 3316 1240 icf.exe 93 PID 1240 wrote to memory of 3316 1240 icf.exe 93 PID 1240 wrote to memory of 3316 1240 icf.exe 93 PID 3316 wrote to memory of 2528 3316 icf.exe 94 PID 3316 wrote to memory of 2528 3316 icf.exe 94 PID 3316 wrote to memory of 2528 3316 icf.exe 94 PID 2528 wrote to memory of 3288 2528 icf.exe 95 PID 2528 wrote to memory of 3288 2528 icf.exe 95 PID 2528 wrote to memory of 3288 2528 icf.exe 95 PID 3288 wrote to memory of 848 3288 icf.exe 96 PID 3288 wrote to memory of 848 3288 icf.exe 96 PID 3288 wrote to memory of 848 3288 icf.exe 96 PID 848 wrote to memory of 4876 848 icf.exe 97 PID 848 wrote to memory of 4876 848 icf.exe 97 PID 848 wrote to memory of 4876 848 icf.exe 97 PID 4876 wrote to memory of 4604 4876 icf.exe 98 PID 4876 wrote to memory of 4604 4876 icf.exe 98 PID 4876 wrote to memory of 4604 4876 icf.exe 98 PID 4604 wrote to memory of 2252 4604 icf.exe 99 PID 4604 wrote to memory of 2252 4604 icf.exe 99 PID 4604 wrote to memory of 2252 4604 icf.exe 99 PID 2252 wrote to memory of 2864 2252 icf.exe 100 PID 2252 wrote to memory of 2864 2252 icf.exe 100 PID 2252 wrote to memory of 2864 2252 icf.exe 100 PID 2864 wrote to memory of 3464 2864 icf.exe 101 PID 2864 wrote to memory of 3464 2864 icf.exe 101 PID 2864 wrote to memory of 3464 2864 icf.exe 101 PID 3464 wrote to memory of 1624 3464 icf.exe 103 PID 3464 wrote to memory of 1624 3464 icf.exe 103 PID 3464 wrote to memory of 1624 3464 icf.exe 103 PID 1624 wrote to memory of 2096 1624 icf.exe 104 PID 1624 wrote to memory of 2096 1624 icf.exe 104 PID 1624 wrote to memory of 2096 1624 icf.exe 104 PID 2096 wrote to memory of 5112 2096 icf.exe 105 PID 2096 wrote to memory of 5112 2096 icf.exe 105 PID 2096 wrote to memory of 5112 2096 icf.exe 105 PID 5112 wrote to memory of 3608 5112 icf.exe 106 PID 5112 wrote to memory of 3608 5112 icf.exe 106 PID 5112 wrote to memory of 3608 5112 icf.exe 106 PID 3608 wrote to memory of 4388 3608 icf.exe 107 PID 3608 wrote to memory of 4388 3608 icf.exe 107 PID 3608 wrote to memory of 4388 3608 icf.exe 107 PID 4388 wrote to memory of 2960 4388 icf.exe 108 PID 4388 wrote to memory of 2960 4388 icf.exe 108 PID 4388 wrote to memory of 2960 4388 icf.exe 108 PID 2960 wrote to memory of 3764 2960 icf.exe 109 PID 2960 wrote to memory of 3764 2960 icf.exe 109 PID 2960 wrote to memory of 3764 2960 icf.exe 109 PID 3764 wrote to memory of 3224 3764 icf.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3c060e5bc498d60bf64880100e5b7f.exe"C:\Users\Admin\AppData\Local\Temp\bc3c060e5bc498d60bf64880100e5b7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe21⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe23⤵
- Executes dropped EXE
PID:3224 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe24⤵
- Executes dropped EXE
PID:1676 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2288 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe26⤵
- Executes dropped EXE
PID:3740 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe27⤵
- Executes dropped EXE
PID:4476 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe28⤵
- Executes dropped EXE
PID:3308 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe29⤵
- Executes dropped EXE
PID:1072 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe30⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2820 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe33⤵
- Executes dropped EXE
PID:2204 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe34⤵
- Executes dropped EXE
PID:4208 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe36⤵
- Executes dropped EXE
PID:2388 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe37⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2012 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe38⤵
- Executes dropped EXE
PID:5056 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe39⤵
- Executes dropped EXE
PID:3120 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe40⤵
- Executes dropped EXE
PID:3604 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe41⤵
- Executes dropped EXE
PID:1436 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe43⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1448 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe44⤵
- Executes dropped EXE
PID:1916 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe45⤵
- Executes dropped EXE
PID:4256 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe46⤵
- Executes dropped EXE
PID:3280 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe48⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3260 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe50⤵
- Executes dropped EXE
PID:5060 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4004 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe53⤵
- Executes dropped EXE
PID:3480 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe54⤵
- Executes dropped EXE
PID:4064 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe56⤵
- Executes dropped EXE
PID:3640 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe57⤵
- Executes dropped EXE
PID:4824 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe58⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1420 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe59⤵
- Executes dropped EXE
PID:640 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe60⤵
- Executes dropped EXE
PID:2412 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe62⤵
- Executes dropped EXE
PID:4336 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe64⤵
- Executes dropped EXE
PID:2172 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe65⤵
- Executes dropped EXE
PID:1380 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe66⤵PID:1852
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe67⤵
- Adds Run key to start application
PID:4664 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe68⤵PID:4328
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe69⤵PID:3172
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe70⤵PID:752
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe71⤵PID:2296
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe72⤵PID:768
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe73⤵PID:3964
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe74⤵PID:1000
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe75⤵PID:936
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe76⤵PID:1752
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe77⤵PID:2620
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe78⤵PID:2920
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe79⤵PID:1068
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe80⤵PID:4376
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe81⤵PID:968
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe82⤵PID:2452
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe83⤵PID:5140
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe84⤵
- Drops file in System32 directory
PID:5164 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe85⤵PID:5184
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe86⤵PID:5204
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe87⤵PID:5228
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe88⤵PID:5256
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe89⤵PID:5276
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe90⤵PID:5300
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe91⤵PID:5324
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe92⤵PID:5344
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe93⤵PID:5364
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe94⤵PID:5380
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe95⤵PID:5396
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe96⤵PID:5408
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe97⤵
- Drops file in System32 directory
PID:5428 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe98⤵PID:5444
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe99⤵PID:5456
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe100⤵PID:5476
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe101⤵PID:5492
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe102⤵PID:5512
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe103⤵
- Adds Run key to start application
PID:5528 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe104⤵
- Drops file in System32 directory
PID:5548 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe105⤵PID:5564
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe106⤵PID:5584
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe107⤵PID:5604
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe108⤵PID:5620
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe109⤵PID:5636
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe110⤵PID:5652
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe111⤵PID:5668
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe112⤵PID:5684
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe113⤵PID:5700
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe114⤵
- Adds Run key to start application
PID:5720 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe115⤵
- Drops file in System32 directory
PID:5736 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe116⤵PID:5752
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe117⤵PID:5764
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe118⤵PID:5780
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe119⤵PID:5800
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe120⤵
- Drops file in System32 directory
PID:5816 -
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe121⤵PID:5836
-
\??\c:\windows\SysWOW64\icf.exec:\windows\system32\icf.exe122⤵PID:5852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-