Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 21:30
Behavioral task
behavioral1
Sample
49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe
-
Size
70KB
-
MD5
a961c118d5dc42b1c299ba9a0c24f041
-
SHA1
f8c8d37f3b95571c8950695fbb6d2456bb97edfd
-
SHA256
49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da
-
SHA512
e07abc0b430c8f60b5a61604b5ab68e3cf7b0b18d030cbce62c395c4208a6756a2cb92fa6f7e6641eec097d6659d3b34b96f6e484f07f38a28271b5b717b746b
-
SSDEEP
1536:oOoq1XuNCQy7vm9iV+sW6VQcFa/SNmBtBneGr4:SK66hW6k6uBneGE
Score
9/10
Malware Config
Signatures
-
Detects executables packed with ASPack 64 IoCs
resource yara_rule behavioral1/files/0x003600000001566b-4.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/996-1661-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2524-2130-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2236-2108-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2676-2133-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1632-2142-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2284-2148-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-2146-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2460-2149-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1572-2150-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2080-2153-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/588-2162-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2040-2175-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3028-2182-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1664-2178-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1812-2189-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2508-2190-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1000-2186-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2224-2194-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2804-2196-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/540-2197-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1648-2207-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1140-2210-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3008-2212-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2520-2213-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2064-2214-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1240-2215-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/996-3145-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2236-3765-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2524-3769-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2676-3771-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-3774-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1632-3773-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2284-3789-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2460-3793-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1572-3797-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/588-3810-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2080-3801-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2040-4509-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1812-4540-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2508-4544-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1000-4535-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3028-4531-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1664-4510-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/540-4581-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2804-4580-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2224-4568-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1648-4583-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3008-4585-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1140-4584-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2520-4586-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2064-4616-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/996-5440-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2524-6250-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2236-6244-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2676-6251-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2284-6282-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2460-6290-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-6278-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1632-6257-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2040-6323-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/588-6313-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2080-6309-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1572-6294-0x0000000000400000-0x000000000042F000-memory.dmp INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x003600000001566b-4.dat aspack_v212_v242 -
Executes dropped EXE 25 IoCs
pid Process 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2508 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2224 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2804 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 540 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1648 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1140 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 3008 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2520 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2064 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1240 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Loads dropped DLL 64 IoCs
pid Process 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Adds Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mshlta = "mshlta.exe" 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Enumerates connected drives 3 TTPs 52 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\A: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened (read-only) \??\B: 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mmc.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\resmon.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\cmd.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\certutil.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\NAPSTAT.EXE 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\NAPSTAT.EXE 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\cmdl32.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\perfmon.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\wscript.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\DisplaySwitch.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\msra.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\OptionalFeatures.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\SecEdit.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\mshlta.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\iscsicli.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\Magnify.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\mshlta.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\calc.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\wusa.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\newdev.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\runonce.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\calc.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\DeviceProperties.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\DpiScaling.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\resmon.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\cmd.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\certutil.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\osk.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\shrpubw.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\newdev.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\cscript.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\msra.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\verifier.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\SysWOW64\migwiz\PostMig.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\notepad.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\notepad.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\ehome\MediaCenterWebLauncher.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\notepad.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\ehome\ehshell.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\notepad.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\ehome\ehshell.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\ehshell.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\notepad.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\HelpPane.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\ehome\loadmxf.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File opened for modification C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe File created C:\Windows\explorer.exe 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 292 1240 WerFault.exe 52 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 2236 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 28 PID 996 wrote to memory of 2236 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 28 PID 996 wrote to memory of 2236 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 28 PID 996 wrote to memory of 2236 996 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 28 PID 2236 wrote to memory of 2524 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 29 PID 2236 wrote to memory of 2524 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 29 PID 2236 wrote to memory of 2524 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 29 PID 2236 wrote to memory of 2524 2236 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 29 PID 2524 wrote to memory of 2676 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 30 PID 2524 wrote to memory of 2676 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 30 PID 2524 wrote to memory of 2676 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 30 PID 2524 wrote to memory of 2676 2524 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 30 PID 2676 wrote to memory of 1632 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 31 PID 2676 wrote to memory of 1632 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 31 PID 2676 wrote to memory of 1632 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 31 PID 2676 wrote to memory of 1632 2676 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 31 PID 1632 wrote to memory of 2784 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 32 PID 1632 wrote to memory of 2784 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 32 PID 1632 wrote to memory of 2784 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 32 PID 1632 wrote to memory of 2784 1632 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 32 PID 2784 wrote to memory of 2284 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 33 PID 2784 wrote to memory of 2284 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 33 PID 2784 wrote to memory of 2284 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 33 PID 2784 wrote to memory of 2284 2784 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 33 PID 2284 wrote to memory of 2460 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 34 PID 2284 wrote to memory of 2460 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 34 PID 2284 wrote to memory of 2460 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 34 PID 2284 wrote to memory of 2460 2284 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 34 PID 2460 wrote to memory of 1572 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 35 PID 2460 wrote to memory of 1572 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 35 PID 2460 wrote to memory of 1572 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 35 PID 2460 wrote to memory of 1572 2460 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 35 PID 1572 wrote to memory of 2080 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 36 PID 1572 wrote to memory of 2080 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 36 PID 1572 wrote to memory of 2080 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 36 PID 1572 wrote to memory of 2080 1572 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 36 PID 2080 wrote to memory of 588 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 37 PID 2080 wrote to memory of 588 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 37 PID 2080 wrote to memory of 588 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 37 PID 2080 wrote to memory of 588 2080 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 37 PID 588 wrote to memory of 2040 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 38 PID 588 wrote to memory of 2040 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 38 PID 588 wrote to memory of 2040 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 38 PID 588 wrote to memory of 2040 588 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 38 PID 2040 wrote to memory of 1664 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 39 PID 2040 wrote to memory of 1664 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 39 PID 2040 wrote to memory of 1664 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 39 PID 2040 wrote to memory of 1664 2040 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 39 PID 1664 wrote to memory of 3028 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 40 PID 1664 wrote to memory of 3028 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 40 PID 1664 wrote to memory of 3028 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 40 PID 1664 wrote to memory of 3028 1664 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 40 PID 3028 wrote to memory of 1000 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 41 PID 3028 wrote to memory of 1000 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 41 PID 3028 wrote to memory of 1000 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 41 PID 3028 wrote to memory of 1000 3028 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 41 PID 1000 wrote to memory of 1812 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 42 PID 1000 wrote to memory of 1812 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 42 PID 1000 wrote to memory of 1812 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 42 PID 1000 wrote to memory of 1812 1000 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 42 PID 1812 wrote to memory of 2508 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 43 PID 1812 wrote to memory of 2508 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 43 PID 1812 wrote to memory of 2508 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 43 PID 1812 wrote to memory of 2508 1812 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"17⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"18⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"19⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"20⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"21⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"22⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"23⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"24⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"25⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"C:\Users\Admin\AppData\Local\Temp\ 49dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da.exe"26⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
PID:1240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 38827⤵
- Program crash
PID:292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5a961c118d5dc42b1c299ba9a0c24f041
SHA1f8c8d37f3b95571c8950695fbb6d2456bb97edfd
SHA25649dd6ac1b2f7536221885cfbd23676ac52d1d4369303414005af29355ff359da
SHA512e07abc0b430c8f60b5a61604b5ab68e3cf7b0b18d030cbce62c395c4208a6756a2cb92fa6f7e6641eec097d6659d3b34b96f6e484f07f38a28271b5b717b746b