Malware Analysis Report

2024-09-11 12:56

Sample ID 240610-244jrsvanc
Target 6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2
SHA256 6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2

Threat Level: Known bad

The file 6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

UPX dump on OEP (original entry point)

Windows security modification

UPX packed file

Enumerates connected drives

Checks whether UAC is enabled

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

System policy modification

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:09

Reported

2024-06-10 23:11

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

wininit.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f7621e2 C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\wininit.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\csrss.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\services.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsm.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 2416 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe

"C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe"

Network

N/A

Files

memory/2416-0-0x0000000000400000-0x0000000000620000-memory.dmp

memory/2416-2-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-8-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-10-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-5-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-37-0x0000000000730000-0x0000000000731000-memory.dmp

memory/2416-7-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-11-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-6-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-40-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2416-12-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-9-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-42-0x0000000000730000-0x0000000000731000-memory.dmp

memory/2416-41-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2416-4-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-36-0x00000000003F0000-0x00000000003F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\windkhh.exe

MD5 40fde4e8e9fe8113be8080eec37c5bbb
SHA1 dd80af1c3ba22b28976bb4184c70c430a273e501
SHA256 17adc6733e3a9d4259ecc2b0ed9c8289448678084393b3cd627a2c572c42cb5c
SHA512 9c27f0b835fd5c6aaa74988558a3d2d89dceab279c0809b715da6bfd2497be7e526822002f2cf2dd2d1c53c3502b770321ad1440393d57f0006e22c41e03a2f3

memory/1108-16-0x0000000002010000-0x0000000002012000-memory.dmp

memory/2416-14-0x0000000077DEF000-0x0000000077DF0000-memory.dmp

memory/2416-13-0x0000000077DF0000-0x0000000077DF1000-memory.dmp

C:\Windows\system.ini

MD5 f6d745915f755a2c356d07856ea7e4fb
SHA1 82f0c47a1e39d4e046923f72975c74b52ca3ca18
SHA256 1db59495bf26ac2b7aa61fe82e0d97d3b41a8c7eb67a4cfcd05e6fb8bb6e3ed5
SHA512 178521c77fce41fee7452bb9e196040fdc733ef3fd65c896439e4bec3ae7ecbe1c1960450103e612f943082eee114bce0b227884edc8ce243adae0bea21ecae9

memory/2416-46-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-45-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-68-0x0000000002190000-0x000000000324A000-memory.dmp

memory/2416-67-0x0000000000400000-0x0000000000620000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:09

Reported

2024-06-10 23:11

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

151s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e574d35 C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\winlogon.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\lsass.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\fontdrvhost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\dwm.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\System32\svchost.exe
PID 444 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe
PID 444 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe C:\Windows\system32\svchost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe N/A

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe

"C:\Users\Admin\AppData\Local\Temp\6b6788a98d3e207cbb894ca21f244d94d9ad605c2e299b1af5673de7ae446bd2.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
CN 60.190.222.139:80 tcp
US 8.8.8.8:53 uajxhd.com udp
US 8.8.8.8:53 bjaevo.com udp
US 52.111.229.43:443 tcp
CN 60.190.222.139:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
CN 60.190.222.139:80 tcp
US 8.8.8.8:53 ant.trenz.pl udp

Files

memory/444-0-0x0000000000400000-0x0000000000620000-memory.dmp

memory/444-1-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-4-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-5-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-3-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-14-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-7-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-8-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-6-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-15-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-19-0x00000000046F0000-0x00000000046F1000-memory.dmp

memory/444-18-0x0000000003620000-0x0000000003622000-memory.dmp

memory/444-16-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-20-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-21-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-22-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/444-24-0x00000000779E3000-0x00000000779E4000-memory.dmp

memory/444-17-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-23-0x00000000779E2000-0x00000000779E3000-memory.dmp

memory/444-25-0x0000000003620000-0x0000000003622000-memory.dmp

memory/444-26-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/444-27-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/444-28-0x0000000003620000-0x0000000003622000-memory.dmp

memory/444-29-0x0000000073F20000-0x0000000073F59000-memory.dmp

memory/444-30-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-33-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-34-0x0000000002520000-0x00000000035DA000-memory.dmp

C:\Windows\system.ini

MD5 b020abb9bc9b823c53e952725ab7e1ae
SHA1 a09cea9c731114d7f5b1f46cbc7cde357671c2ba
SHA256 cc8c64659c8859e15cd4edfb6a04b6c16cc25a82de458fd045f68113025003c5
SHA512 11a53e7255f6b7220c18bf9b1cc8b54d442cb9c7a071b123dbe636eef7b56bd87f895b1656cba08189e5493d5dbe2cbeacefff2b3bc4d176de2bcae5ed5cef72

memory/444-42-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-43-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-44-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-46-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-47-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-49-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-51-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-54-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-56-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-58-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-61-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-62-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-64-0x0000000000400000-0x0000000000620000-memory.dmp

memory/444-65-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-67-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-69-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-71-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-72-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-86-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-88-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-90-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-92-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-94-0x0000000003620000-0x0000000003622000-memory.dmp

memory/444-95-0x0000000002520000-0x00000000035DA000-memory.dmp

memory/444-97-0x0000000002520000-0x00000000035DA000-memory.dmp

C:\cmtyo.pif

MD5 8c3664ea2df03ab082a6585fb45631b9
SHA1 7b466b2bde9163c3424dfd5e59063b799cc49377
SHA256 45f8b87f87afe2bb50c3fdfcc1a9dc97969ff951523ff03767bf5167fe832c51
SHA512 622cee93be35f138c1228e5da22130a310a383b3e126ef6870afcb2b351dd5cb04d7e17915b19d0b3e71e907a95ee45abd14190b70f4110d3e5d16a53303ac39