Analysis
-
max time kernel
62s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
c2e96de70e518631646a16154cd2dab8.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c2e96de70e518631646a16154cd2dab8.exe
Resource
win10v2004-20240226-en
General
-
Target
c2e96de70e518631646a16154cd2dab8.exe
-
Size
80KB
-
MD5
c2e96de70e518631646a16154cd2dab8
-
SHA1
899de7a75187996ecc2e1cbe58c38c010dd57692
-
SHA256
cab376dba17f99ab31a0eda48dc13c278d356b21a47cffb5dbfaa6856ad65b34
-
SHA512
76b99bce1475eee6410a567f1376feb814f0e2f1cf16b4dc479562ec1a1e17f692a4c0c8d09298346741d78cdec5452640f898cbb6ddb749dab4fb4ed066be2c
-
SSDEEP
768:cDI8ys6q0TMm1zJHZ+GaBb2Vxit/vqJevfoJ6DVSLKvomVWdXW7X4sn:cDk1zH3cHBb2VxUcpKVSLChVWdXi
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 40 1468 sihclient.exe 44 1468 sihclient.exe 46 1468 sihclient.exe 50 1468 sihclient.exe -
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts c2e96de70e518631646a16154cd2dab8.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe File opened for modification C:\Windows\system32\drivers\etc\hosts v6msn.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation c2e96de70e518631646a16154cd2dab8.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation v6msn.exe -
Executes dropped EXE 64 IoCs
pid Process 3044 v6msn.exe 2968 v6msn.exe 3096 v6msn.exe 1624 v6msn.exe 4112 v6msn.exe 3032 v6msn.exe 324 v6msn.exe 3584 v6msn.exe 1996 v6msn.exe 1256 v6msn.exe 2756 v6msn.exe 4988 v6msn.exe 2156 v6msn.exe 2252 v6msn.exe 2292 v6msn.exe 1416 v6msn.exe 2220 v6msn.exe 3468 v6msn.exe 960 v6msn.exe 4092 v6msn.exe 2156 v6msn.exe 2372 v6msn.exe 2872 v6msn.exe 2008 v6msn.exe 2688 v6msn.exe 1680 v6msn.exe 772 v6msn.exe 3660 v6msn.exe 3788 v6msn.exe 2872 v6msn.exe 5048 v6msn.exe 1472 v6msn.exe 3204 v6msn.exe 5012 v6msn.exe 1524 v6msn.exe 3188 v6msn.exe 1964 v6msn.exe 2896 v6msn.exe 4928 v6msn.exe 3448 v6msn.exe 2380 v6msn.exe 1524 v6msn.exe 4708 v6msn.exe 4512 v6msn.exe 772 v6msn.exe 1700 v6msn.exe 1480 v6msn.exe 4508 v6msn.exe 1972 v6msn.exe 1344 v6msn.exe 4616 v6msn.exe 772 v6msn.exe 668 v6msn.exe 2396 v6msn.exe 3608 v6msn.exe 4984 v6msn.exe 2576 v6msn.exe 2536 v6msn.exe 4308 v6msn.exe 4856 v6msn.exe 1944 v6msn.exe 3788 v6msn.exe 2484 v6msn.exe 4288 v6msn.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" c2e96de70e518631646a16154cd2dab8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN6.1 Auto-Updater = "v6msn.exe" v6msn.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe c2e96de70e518631646a16154cd2dab8.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File created C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe c2e96de70e518631646a16154cd2dab8.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe File opened for modification C:\Windows\SysWOW64\v6msn.exe v6msn.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 5060 set thread context of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 3044 set thread context of 2968 3044 v6msn.exe 96 PID 3096 set thread context of 1624 3096 v6msn.exe 110 PID 4112 set thread context of 3032 4112 v6msn.exe 125 PID 324 set thread context of 3584 324 v6msn.exe 135 PID 1996 set thread context of 1256 1996 v6msn.exe 145 PID 2756 set thread context of 4988 2756 v6msn.exe 157 PID 2156 set thread context of 2252 2156 v6msn.exe 169 PID 2292 set thread context of 1416 2292 v6msn.exe 184 PID 2220 set thread context of 3468 2220 v6msn.exe 193 PID 960 set thread context of 4092 960 v6msn.exe 206 PID 2156 set thread context of 2372 2156 v6msn.exe 217 PID 2872 set thread context of 2008 2872 v6msn.exe 230 PID 2688 set thread context of 1680 2688 v6msn.exe 246 PID 772 set thread context of 3660 772 v6msn.exe 256 PID 3788 set thread context of 2872 3788 v6msn.exe 272 PID 5048 set thread context of 1472 5048 v6msn.exe 285 PID 3204 set thread context of 5012 3204 v6msn.exe 383 PID 1524 set thread context of 3188 1524 v6msn.exe 306 PID 1964 set thread context of 2896 1964 v6msn.exe 318 PID 4928 set thread context of 3448 4928 v6msn.exe 579 PID 2380 set thread context of 1524 2380 v6msn.exe 346 PID 4708 set thread context of 4512 4708 v6msn.exe 355 PID 772 set thread context of 1700 772 v6msn.exe 371 PID 1480 set thread context of 4508 1480 v6msn.exe 375 PID 1972 set thread context of 1344 1972 v6msn.exe 392 PID 4616 set thread context of 772 4616 v6msn.exe 775 PID 668 set thread context of 2396 668 v6msn.exe 417 PID 3608 set thread context of 4984 3608 v6msn.exe 888 PID 2576 set thread context of 2536 2576 v6msn.exe 442 PID 4308 set thread context of 4856 4308 v6msn.exe 616 PID 1944 set thread context of 3788 1944 v6msn.exe 517 PID 2484 set thread context of 4288 2484 v6msn.exe 843 PID 1092 set thread context of 1396 1092 v6msn.exe 962 PID 3236 set thread context of 3608 3236 v6msn.exe 505 PID 1972 set thread context of 2512 1972 v6msn.exe 516 PID 516 set thread context of 1308 516 v6msn.exe 525 PID 4424 set thread context of 3036 4424 v6msn.exe 538 PID 3056 set thread context of 1188 3056 v6msn.exe 1075 PID 1488 set thread context of 1540 1488 v6msn.exe 562 PID 1904 set thread context of 4284 1904 v6msn.exe 707 PID 3448 set thread context of 4232 3448 v6msn.exe 589 PID 2484 set thread context of 5048 2484 v6msn.exe 1180 PID 3628 set thread context of 4348 3628 v6msn.exe 613 PID 1284 set thread context of 5076 1284 v6msn.exe 1363 PID 2912 set thread context of 404 2912 v6msn.exe 1049 PID 772 set thread context of 4120 772 v6msn.exe 1186 PID 3632 set thread context of 3336 3632 v6msn.exe 1257 PID 4072 set thread context of 4112 4072 v6msn.exe 670 PID 1420 set thread context of 3588 1420 v6msn.exe 1269 PID 3724 set thread context of 4620 3724 v6msn.exe 694 PID 2344 set thread context of 1724 2344 v6msn.exe 1301 PID 1756 set thread context of 2448 1756 v6msn.exe 718 PID 2424 set thread context of 324 2424 v6msn.exe 734 PID 4148 set thread context of 3644 4148 v6msn.exe 743 PID 1364 set thread context of 3344 1364 v6msn.exe 754 PID 5040 set thread context of 5032 5040 v6msn.exe 766 PID 1824 set thread context of 2016 1824 v6msn.exe 1652 PID 1492 set thread context of 2344 1492 v6msn.exe 1681 PID 320 set thread context of 3568 320 v6msn.exe 1743 PID 3592 set thread context of 4436 3592 v6msn.exe 814 PID 4504 set thread context of 2896 4504 v6msn.exe 826 PID 4036 set thread context of 3288 4036 v6msn.exe 1459 PID 4696 set thread context of 2052 4696 v6msn.exe 1866 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c2e96de70e518631646a16154cd2dab8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ v6msn.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4864 c2e96de70e518631646a16154cd2dab8.exe Token: SeIncBasePriorityPrivilege 2968 v6msn.exe Token: SeIncBasePriorityPrivilege 1624 v6msn.exe Token: SeIncBasePriorityPrivilege 3032 v6msn.exe Token: SeIncBasePriorityPrivilege 3584 v6msn.exe Token: SeIncBasePriorityPrivilege 1256 v6msn.exe Token: SeIncBasePriorityPrivilege 4988 v6msn.exe Token: SeIncBasePriorityPrivilege 2252 v6msn.exe Token: SeIncBasePriorityPrivilege 1416 v6msn.exe Token: SeIncBasePriorityPrivilege 3468 v6msn.exe Token: SeIncBasePriorityPrivilege 4092 v6msn.exe Token: SeIncBasePriorityPrivilege 2372 v6msn.exe Token: SeIncBasePriorityPrivilege 2008 v6msn.exe Token: SeIncBasePriorityPrivilege 1680 v6msn.exe Token: SeIncBasePriorityPrivilege 3660 v6msn.exe Token: SeIncBasePriorityPrivilege 2872 v6msn.exe Token: SeIncBasePriorityPrivilege 1472 v6msn.exe Token: SeIncBasePriorityPrivilege 5012 v6msn.exe Token: SeIncBasePriorityPrivilege 3188 v6msn.exe Token: SeIncBasePriorityPrivilege 2896 v6msn.exe Token: SeIncBasePriorityPrivilege 3448 v6msn.exe Token: SeIncBasePriorityPrivilege 1524 v6msn.exe Token: SeIncBasePriorityPrivilege 4512 v6msn.exe Token: SeIncBasePriorityPrivilege 1700 v6msn.exe Token: SeIncBasePriorityPrivilege 4508 v6msn.exe Token: SeIncBasePriorityPrivilege 1344 v6msn.exe Token: SeIncBasePriorityPrivilege 772 v6msn.exe Token: SeIncBasePriorityPrivilege 2396 v6msn.exe Token: SeIncBasePriorityPrivilege 4984 v6msn.exe Token: SeIncBasePriorityPrivilege 2536 v6msn.exe Token: SeIncBasePriorityPrivilege 4856 v6msn.exe Token: SeIncBasePriorityPrivilege 3788 v6msn.exe Token: SeIncBasePriorityPrivilege 4288 v6msn.exe Token: SeIncBasePriorityPrivilege 1396 v6msn.exe Token: SeIncBasePriorityPrivilege 3608 v6msn.exe Token: SeIncBasePriorityPrivilege 2512 v6msn.exe Token: SeIncBasePriorityPrivilege 1308 v6msn.exe Token: SeIncBasePriorityPrivilege 3036 v6msn.exe Token: SeIncBasePriorityPrivilege 1188 v6msn.exe Token: SeIncBasePriorityPrivilege 1540 v6msn.exe Token: SeIncBasePriorityPrivilege 4284 v6msn.exe Token: SeIncBasePriorityPrivilege 4232 v6msn.exe Token: SeIncBasePriorityPrivilege 5048 v6msn.exe Token: SeIncBasePriorityPrivilege 4348 v6msn.exe Token: SeIncBasePriorityPrivilege 5076 v6msn.exe Token: SeIncBasePriorityPrivilege 404 v6msn.exe Token: SeIncBasePriorityPrivilege 4120 v6msn.exe Token: SeIncBasePriorityPrivilege 3336 v6msn.exe Token: SeIncBasePriorityPrivilege 4112 v6msn.exe Token: SeIncBasePriorityPrivilege 3588 v6msn.exe Token: SeIncBasePriorityPrivilege 4620 v6msn.exe Token: SeIncBasePriorityPrivilege 1724 v6msn.exe Token: SeIncBasePriorityPrivilege 2448 v6msn.exe Token: SeIncBasePriorityPrivilege 324 v6msn.exe Token: SeIncBasePriorityPrivilege 3644 v6msn.exe Token: SeIncBasePriorityPrivilege 3344 v6msn.exe Token: SeIncBasePriorityPrivilege 5032 v6msn.exe Token: SeIncBasePriorityPrivilege 2016 v6msn.exe Token: SeIncBasePriorityPrivilege 2344 v6msn.exe Token: SeIncBasePriorityPrivilege 3568 v6msn.exe Token: SeIncBasePriorityPrivilege 4436 v6msn.exe Token: SeIncBasePriorityPrivilege 2896 v6msn.exe Token: SeIncBasePriorityPrivilege 3288 v6msn.exe Token: SeIncBasePriorityPrivilege 2052 v6msn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 5060 wrote to memory of 4864 5060 c2e96de70e518631646a16154cd2dab8.exe 87 PID 4864 wrote to memory of 3044 4864 c2e96de70e518631646a16154cd2dab8.exe 91 PID 4864 wrote to memory of 3044 4864 c2e96de70e518631646a16154cd2dab8.exe 91 PID 4864 wrote to memory of 3044 4864 c2e96de70e518631646a16154cd2dab8.exe 91 PID 4864 wrote to memory of 4772 4864 c2e96de70e518631646a16154cd2dab8.exe 92 PID 4864 wrote to memory of 4772 4864 c2e96de70e518631646a16154cd2dab8.exe 92 PID 4864 wrote to memory of 4772 4864 c2e96de70e518631646a16154cd2dab8.exe 92 PID 4864 wrote to memory of 3456 4864 c2e96de70e518631646a16154cd2dab8.exe 93 PID 4864 wrote to memory of 3456 4864 c2e96de70e518631646a16154cd2dab8.exe 93 PID 4864 wrote to memory of 3456 4864 c2e96de70e518631646a16154cd2dab8.exe 93 PID 4864 wrote to memory of 972 4864 c2e96de70e518631646a16154cd2dab8.exe 94 PID 4864 wrote to memory of 972 4864 c2e96de70e518631646a16154cd2dab8.exe 94 PID 4864 wrote to memory of 972 4864 c2e96de70e518631646a16154cd2dab8.exe 94 PID 4864 wrote to memory of 4964 4864 c2e96de70e518631646a16154cd2dab8.exe 95 PID 4864 wrote to memory of 4964 4864 c2e96de70e518631646a16154cd2dab8.exe 95 PID 4864 wrote to memory of 4964 4864 c2e96de70e518631646a16154cd2dab8.exe 95 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 4864 wrote to memory of 1344 4864 c2e96de70e518631646a16154cd2dab8.exe 97 PID 4864 wrote to memory of 1344 4864 c2e96de70e518631646a16154cd2dab8.exe 97 PID 4864 wrote to memory of 1344 4864 c2e96de70e518631646a16154cd2dab8.exe 97 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 3044 wrote to memory of 2968 3044 v6msn.exe 96 PID 2968 wrote to memory of 3096 2968 v6msn.exe 103 PID 2968 wrote to memory of 3096 2968 v6msn.exe 103 PID 2968 wrote to memory of 3096 2968 v6msn.exe 103 PID 2968 wrote to memory of 1584 2968 v6msn.exe 160 PID 2968 wrote to memory of 1584 2968 v6msn.exe 160 PID 2968 wrote to memory of 1584 2968 v6msn.exe 160 PID 2968 wrote to memory of 4988 2968 v6msn.exe 157 PID 2968 wrote to memory of 4988 2968 v6msn.exe 157 PID 2968 wrote to memory of 4988 2968 v6msn.exe 157 PID 2968 wrote to memory of 3952 2968 v6msn.exe 106 PID 2968 wrote to memory of 3952 2968 v6msn.exe 106 PID 2968 wrote to memory of 3952 2968 v6msn.exe 106 PID 2968 wrote to memory of 4000 2968 v6msn.exe 107 PID 2968 wrote to memory of 4000 2968 v6msn.exe 107 PID 2968 wrote to memory of 4000 2968 v6msn.exe 107 PID 2968 wrote to memory of 4980 2968 v6msn.exe 108 PID 2968 wrote to memory of 4980 2968 v6msn.exe 108 PID 2968 wrote to memory of 4980 2968 v6msn.exe 108 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 3096 wrote to memory of 1624 3096 v6msn.exe 110 PID 1624 wrote to memory of 4112 1624 v6msn.exe 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e96de70e518631646a16154cd2dab8.exe"C:\Users\Admin\AppData\Local\Temp\c2e96de70e518631646a16154cd2dab8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\c2e96de70e518631646a16154cd2dab8.exe"C:\Users\Admin\AppData\Local\Temp\c2e96de70e518631646a16154cd2dab8.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"4⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"6⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4112 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"8⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:324 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"10⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1996 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"12⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2756 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"14⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4988 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2156 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"16⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2292 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"18⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2220 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"20⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:960 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"22⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2156 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"24⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2872 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"26⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2688 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"28⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:772 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"30⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3660 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"32⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5048 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"34⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3204 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"36⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5012 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1524 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"38⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3188 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1964 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"40⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4928 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"42⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3448 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2380 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"44⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4708 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4512 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:772 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"48⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1480 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"50⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4508 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1972 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"52⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4616 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"54⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:772 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:668 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"56⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3608 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"58⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4984 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2576 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"60⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4308 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"62⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4856 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1944 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"64⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3788 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2484 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"66⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4288 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"67⤵
- Suspicious use of SetThreadContext
PID:1092 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"68⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"69⤵
- Suspicious use of SetThreadContext
PID:3236 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"70⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"71⤵
- Suspicious use of SetThreadContext
PID:1972 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"72⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2512 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"73⤵
- Suspicious use of SetThreadContext
PID:516 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"74⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"75⤵
- Suspicious use of SetThreadContext
PID:4424 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"76⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"77⤵
- Suspicious use of SetThreadContext
PID:3056 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"78⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1188 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"79⤵
- Suspicious use of SetThreadContext
PID:1488 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"80⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"81⤵
- Suspicious use of SetThreadContext
PID:1904 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"82⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4284 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"83⤵
- Suspicious use of SetThreadContext
PID:3448 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"84⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"85⤵
- Suspicious use of SetThreadContext
PID:2484 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"86⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5048 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"87⤵
- Suspicious use of SetThreadContext
PID:3628 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"88⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4348 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"89⤵
- Suspicious use of SetThreadContext
PID:1284 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"90⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5076 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"91⤵
- Suspicious use of SetThreadContext
PID:2912 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"92⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"93⤵
- Suspicious use of SetThreadContext
PID:772 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"94⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"95⤵
- Suspicious use of SetThreadContext
PID:3632 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"96⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3336 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"97⤵
- Suspicious use of SetThreadContext
PID:4072 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"98⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4112 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"99⤵
- Suspicious use of SetThreadContext
PID:1420 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"100⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3588 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"101⤵
- Suspicious use of SetThreadContext
PID:3724 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"102⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"103⤵
- Suspicious use of SetThreadContext
PID:2344 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"104⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"105⤵
- Suspicious use of SetThreadContext
PID:1756 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"106⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"107⤵
- Suspicious use of SetThreadContext
PID:2424 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"108⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:324 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"109⤵
- Suspicious use of SetThreadContext
PID:4148 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"110⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3644 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"111⤵
- Suspicious use of SetThreadContext
PID:1364 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"112⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3344 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"113⤵
- Suspicious use of SetThreadContext
PID:5040 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"114⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5032 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"115⤵
- Suspicious use of SetThreadContext
PID:1824 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"116⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"117⤵
- Suspicious use of SetThreadContext
PID:1492 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"118⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"119⤵
- Suspicious use of SetThreadContext
PID:320 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"120⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3568 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\system32\v6msn.exe"121⤵
- Suspicious use of SetThreadContext
PID:3592 -
C:\Windows\SysWOW64\v6msn.exe"C:\Windows\SysWOW64\v6msn.exe"122⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-