Malware Analysis Report

2024-09-11 12:56

Sample ID 240610-y355esyepg
Target 2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f
SHA256 2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f

Threat Level: Known bad

The file 2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Windows security bypass

Modifies firewall policy service

Sality

Modifies visiblity of hidden/system files in Explorer

UAC bypass

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

UPX dump on OEP (original entry point)

Deletes itself

UPX packed file

Windows security modification

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Adds Run key to start application

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

System policy modification

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-10 20:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 20:19

Reported

2024-06-10 20:22

Platform

win7-20240221-en

Max time kernel

29s

Max time network

123s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc \??\c:\windows\resources\themes\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\N: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\G: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\H: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\I: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\O: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\P: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\S: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\K: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\L: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\M: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\E: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\E: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\Q: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\R: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\G: \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification C:\Windows\SYSTEM.INI \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\resources\themes\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 2320 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 2320 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 2320 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 2320 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2320 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2320 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2320 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2232 wrote to memory of 2032 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2232 wrote to memory of 2032 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2232 wrote to memory of 2032 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2232 wrote to memory of 2032 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2216 wrote to memory of 1180 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\taskhost.exe
PID 2216 wrote to memory of 1312 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\Dwm.exe
PID 2216 wrote to memory of 1368 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Explorer.EXE
PID 2216 wrote to memory of 460 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\DllHost.exe
PID 2216 wrote to memory of 2320 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe
PID 2216 wrote to memory of 2320 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe
PID 2216 wrote to memory of 2232 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 2216 wrote to memory of 2232 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 2216 wrote to memory of 2332 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\conhost.exe
PID 2032 wrote to memory of 2548 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2032 wrote to memory of 2548 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2032 wrote to memory of 2548 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2032 wrote to memory of 2548 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2548 wrote to memory of 2432 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2548 wrote to memory of 2432 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2548 wrote to memory of 2432 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2548 wrote to memory of 2432 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2432 wrote to memory of 2456 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2432 wrote to memory of 2456 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2432 wrote to memory of 2456 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2432 wrote to memory of 2456 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2032 wrote to memory of 1904 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2032 wrote to memory of 1904 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2032 wrote to memory of 1904 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2032 wrote to memory of 1904 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.exe
PID 2432 wrote to memory of 1112 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 1112 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 1112 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 1112 N/A \??\c:\windows\resources\svchost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2216 wrote to memory of 1180 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\taskhost.exe
PID 2216 wrote to memory of 1312 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\Dwm.exe
PID 2216 wrote to memory of 1368 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Explorer.EXE
PID 2216 wrote to memory of 2332 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\conhost.exe
PID 2216 wrote to memory of 2032 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\themes\explorer.exe
PID 2216 wrote to memory of 2032 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\themes\explorer.exe
PID 2216 wrote to memory of 2432 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\svchost.exe
PID 2216 wrote to memory of 2432 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\svchost.exe
PID 2032 wrote to memory of 1180 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\system32\taskhost.exe
PID 2032 wrote to memory of 1312 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\system32\Dwm.exe
PID 2032 wrote to memory of 1368 N/A \??\c:\windows\resources\themes\explorer.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe

"C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe"

\??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-12585533895958160810319371281668936508-845322938354380835-32925554-556094992"

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:21 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:22 /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:23 /f

Network

N/A

Files

memory/2320-0-0x0000000000400000-0x000000000041F000-memory.dmp

\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

MD5 44981b4bc4a2a86d97d9daa4dfdc56c9
SHA1 34de2285a03a85eabbe026dbde0a832472253df4
SHA256 dab149bc4edcc9e8762df554bf96544cc70c0a549598a70f89b5064a4e557e53
SHA512 0441f7685f812675ef28db2d622111a4a5a5362a659b553a2ed78a73abeed45580915bd2c5dd0e8ff77df2bab0e46cc60d2dfcd7427f8201c8029b9baf28af98

memory/2320-7-0x00000000002A0000-0x00000000002D1000-memory.dmp

\Windows\Resources\Themes\icsys.icn.exe

MD5 10bf281bd01dcdf7759c981fbf652071
SHA1 3954d13520598847ba6e907cf3a62b47c7ec75e1
SHA256 603f4b2906e73b7a46d7312ae7441a8596817a67e8985030c782d109445f8812
SHA512 91aaf2618eba99f6964b2e38d2735589a09c538342359ffb66161a72322b58d4e789ed09ccda771f8f519c63bbfaec2b87720bd2cc5837c1c24d7bbc589d1d1f

memory/2320-18-0x00000000002A0000-0x00000000002BF000-memory.dmp

\Windows\Resources\Themes\explorer.exe

MD5 08218b37b1eb854e8fd8dd0859c5fe00
SHA1 1d5d5a35ff77b1440be0d1cf7214e4427d49e351
SHA256 6b99c9c859c38b75a8dbe0fd148a71235bf3d2f69f48663d1195e95526d48608
SHA512 c3a94072d5a927d9bfd97997761c3d5a121bbd537b2d6185429d3ffc4fe13be7972efc4db75b2edca5ec63dbf178ac83028d171610aaace66656b6084615c0c0

memory/2232-58-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2216-27-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-31-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-30-0x0000000000610000-0x000000000169E000-memory.dmp

memory/1180-39-0x0000000001B40000-0x0000000001B42000-memory.dmp

memory/2216-29-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-28-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-36-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2232-63-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2232-67-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2320-66-0x00000000001F0000-0x00000000001F2000-memory.dmp

\Windows\Resources\spoolsv.exe

MD5 04afaf1c88170ff539ad04a5bb66cd45
SHA1 cadd3a6e44b1cd9a5b9a3520bc824d5a8b4b2d50
SHA256 5b1cb6251026aa49115068179b6ea1838ea3141f648079be8492e2400452071b
SHA512 d99a06b7e211f77ab8ebbc3ab9b0260f0dafc36e7d44d969c871ea1f2d90e686a252c5009d58fc61fa1566bb16306c0d40ee8fe7906d701d3505579d7c344d9a

memory/2032-76-0x0000000000270000-0x000000000028F000-memory.dmp

memory/2216-65-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/2216-64-0x0000000000610000-0x000000000169E000-memory.dmp

C:\Windows\Resources\svchost.exe

MD5 58a09cb3b5da1c50b98e594180213477
SHA1 0da72b75d76948a2c8a79ddf28ed95e488e5baf5
SHA256 15ea2c75e14ece8644c858a3550f91931aaae32e29f29effe03aaed8b06c85f6
SHA512 bc0597f8f4785d7ea941a876b1e1ee438f07b44c74b23dd0d1a7c1b609d9b96c3d9a300f379ff298d7be42d8e5a0786f3612feb4e70872dd0b9e9365f88f532c

memory/2548-88-0x0000000000310000-0x000000000032F000-memory.dmp

memory/2216-37-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2320-62-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/2216-61-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/2216-32-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-54-0x0000000000500000-0x0000000000501000-memory.dmp

memory/2320-48-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/2320-47-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/2320-46-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/2456-101-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2216-93-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2548-102-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2216-95-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2320-110-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2320-107-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/2232-106-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2232-103-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2216-111-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-112-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-113-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-115-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-116-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-118-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-120-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-121-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/2216-123-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-122-0x0000000000610000-0x000000000169E000-memory.dmp

memory/2216-186-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2216-187-0x0000000000610000-0x000000000169E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 4a8a8bdf30ca86c6002d6db121d3157f
SHA1 b470d16a14259f1c6db9c1c41cd1510c6c117db4
SHA256 0591bcefdd4f012c0fcf0fa919cd94fb1c39c17cf5910b8997be5a098c9cba17
SHA512 2bf53377530c98f41740c266eeedce280e9b9769b779dbd81d4f85fc8f48b473d44c3d357b19023aeeba5a149818f78dead38f2ff8d060452dc5e47edd7a711c

C:\vcvd.pif

MD5 e88fbbf3ada0de81ab0829ad20612cd6
SHA1 614732e31327af7ad81c4fd7a10a1b665166acc6
SHA256 aadaf7fb9917a173e095f35aeea85fe62e141e307b4691256453c0d638054d29
SHA512 d6c1e0246f09beab64ee9bf61b95f9b7003c11be97c302be7f6295a15f2d888a5e348be2e6a53ee26662be4cc5a15a8126ff621ee1081473fe13711d9cc67c46

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 20:19

Reported

2024-06-10 20:22

Platform

win10v2004-20240508-en

Max time kernel

33s

Max time network

148s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\resources\themes\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\H: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\J: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\K: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\I: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\M: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\L: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\R: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\H: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\K: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\J: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\P: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\S: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\E: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\G: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\Q: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\E: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\I: \??\c:\windows\resources\themes\explorer.exe N/A
File opened (read-only) \??\N: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened (read-only) \??\O: \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification C:\Windows\SYSTEM.INI \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4692 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 4692 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 4692 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
PID 4692 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4692 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4692 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 1632 wrote to memory of 4336 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1632 wrote to memory of 4336 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1632 wrote to memory of 4336 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4336 wrote to memory of 1056 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4336 wrote to memory of 1056 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4336 wrote to memory of 1056 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 512 wrote to memory of 792 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\fontdrvhost.exe
PID 512 wrote to memory of 800 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\fontdrvhost.exe
PID 512 wrote to memory of 60 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\dwm.exe
PID 512 wrote to memory of 2948 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\sihost.exe
PID 512 wrote to memory of 2976 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\svchost.exe
PID 512 wrote to memory of 2748 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\taskhostw.exe
PID 512 wrote to memory of 3472 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Explorer.EXE
PID 512 wrote to memory of 3596 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\svchost.exe
PID 512 wrote to memory of 3772 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\DllHost.exe
PID 512 wrote to memory of 3864 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 512 wrote to memory of 3932 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 512 wrote to memory of 4052 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 512 wrote to memory of 4152 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 512 wrote to memory of 4500 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 1056 wrote to memory of 1608 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1056 wrote to memory of 1608 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1056 wrote to memory of 1608 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 512 wrote to memory of 2264 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 512 wrote to memory of 2388 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 512 wrote to memory of 1224 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 512 wrote to memory of 3616 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 512 wrote to memory of 2756 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 512 wrote to memory of 1616 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 512 wrote to memory of 1856 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\backgroundTaskHost.exe
PID 512 wrote to memory of 4692 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe
PID 512 wrote to memory of 4692 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe
PID 512 wrote to memory of 2764 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\Conhost.exe
PID 512 wrote to memory of 1632 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 512 wrote to memory of 1632 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Resources\Themes\icsys.icn.exe
PID 512 wrote to memory of 4336 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\themes\explorer.exe
PID 512 wrote to memory of 4336 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\themes\explorer.exe
PID 512 wrote to memory of 1056 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\spoolsv.exe
PID 512 wrote to memory of 1056 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  \??\c:\windows\resources\spoolsv.exe
PID 1608 wrote to memory of 3144 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1608 wrote to memory of 3144 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1608 wrote to memory of 3144 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 512 wrote to memory of 792 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\fontdrvhost.exe
PID 512 wrote to memory of 800 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\fontdrvhost.exe
PID 512 wrote to memory of 60 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\dwm.exe
PID 512 wrote to memory of 2948 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\sihost.exe
PID 512 wrote to memory of 2976 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\svchost.exe
PID 512 wrote to memory of 2748 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\taskhostw.exe
PID 512 wrote to memory of 3472 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\Explorer.EXE
PID 512 wrote to memory of 3596 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\svchost.exe
PID 512 wrote to memory of 3772 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\system32\DllHost.exe
PID 512 wrote to memory of 3864 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 512 wrote to memory of 3932 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 512 wrote to memory of 4052 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 512 wrote to memory of 4152 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 512 wrote to memory of 4500 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\System32\RuntimeBroker.exe
PID 512 wrote to memory of 2264 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 512 wrote to memory of 2388 N/A \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe  N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\resources\themes\explorer.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7fffdd3dceb8,0x7fffdd3dcec4,0x7fffdd3dced0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2588,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1868,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2084,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe

"C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe"

\??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4312,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\dwm.exe

"dwm.exe"

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp

Files

memory/4692-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 

MD5 44981b4bc4a2a86d97d9daa4dfdc56c9
SHA1 34de2285a03a85eabbe026dbde0a832472253df4
SHA256 dab149bc4edcc9e8762df554bf96544cc70c0a549598a70f89b5064a4e557e53
SHA512 0441f7685f812675ef28db2d622111a4a5a5362a659b553a2ed78a73abeed45580915bd2c5dd0e8ff77df2bab0e46cc60d2dfcd7427f8201c8029b9baf28af98

memory/512-8-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 10bf281bd01dcdf7759c981fbf652071
SHA1 3954d13520598847ba6e907cf3a62b47c7ec75e1
SHA256 603f4b2906e73b7a46d7312ae7441a8596817a67e8985030c782d109445f8812
SHA512 91aaf2618eba99f6964b2e38d2735589a09c538342359ffb66161a72322b58d4e789ed09ccda771f8f519c63bbfaec2b87720bd2cc5837c1c24d7bbc589d1d1f

memory/1632-11-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 d4de75225f1b86039e70658414b08cda
SHA1 03d9a272df1d3432a79d87c50f709097d318e0e0
SHA256 0b952c6ff91adaeb9bb8b3f1ad07846bfd46f193d9b9c511904c93f7219783cc
SHA512 309a4eddeb5aa179b3a104bc9549c35d3b5441b367b0de2a7e230b7e986bb469836057fdf1e3305664cfb9b0593d0544326b03a10fbf29a75217952546065740

memory/512-22-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-25-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-28-0x00000000007A0000-0x000000000182E000-memory.dmp

\??\c:\windows\resources\spoolsv.exe

MD5 8750e38c1396a5d7f71e05d99193dca9
SHA1 6958c9f8a9754405006e45e68f984a6af7b6bf19
SHA256 2addb06defab45dc9120aa00234f5a580b33c5db8abfa68ff621f347f940f980
SHA512 c4a35d63be602f43733e8fa34cb671293d05ee0491916597a47551b690584b1bafa9769dbdfb0e66b2f1810efbb43009e8cd36838b7ec897f5425b9c4a5518f8

memory/1056-42-0x0000000000400000-0x000000000041F000-memory.dmp

\??\c:\windows\resources\svchost.exe

MD5 f638e516847689a0f67145b1975689e1
SHA1 44f0673a6a549d4180a9e9c0ac4e6aa1f06e3b3c
SHA256 b456409fa1af255ef4a50146b73ba92138952277fd9564d55bb94592b395fca4
SHA512 ea4f95fabe0a46b5c5ea064292169d18d348502c658beb3ff78e421a1c052a2434067e756e29cd4c617379d2e46589a4ebb42115968d1c0d21a23acc7ef87396

memory/4336-70-0x00000000005D0000-0x00000000005D2000-memory.dmp

memory/512-37-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/4692-90-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4692-87-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/1632-86-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1632-83-0x0000000002060000-0x0000000002062000-memory.dmp

memory/1056-82-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1056-79-0x0000000001F20000-0x0000000001F22000-memory.dmp

memory/3144-78-0x0000000000400000-0x000000000041F000-memory.dmp

memory/512-77-0x0000000000570000-0x0000000000572000-memory.dmp

memory/512-72-0x0000000000570000-0x0000000000572000-memory.dmp

memory/1056-71-0x0000000001F20000-0x0000000001F22000-memory.dmp

memory/1632-69-0x0000000002060000-0x0000000002062000-memory.dmp

memory/4692-68-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/1608-67-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1056-66-0x0000000001F20000-0x0000000001F22000-memory.dmp

memory/4336-65-0x00000000005D0000-0x00000000005D2000-memory.dmp

memory/1632-64-0x0000000002060000-0x0000000002062000-memory.dmp

memory/4692-63-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/512-47-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-36-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/1056-57-0x0000000002020000-0x0000000002021000-memory.dmp

memory/4336-55-0x00000000028E0000-0x00000000028E1000-memory.dmp

memory/1632-53-0x00000000029E0000-0x00000000029E1000-memory.dmp

memory/512-51-0x0000000001970000-0x0000000001971000-memory.dmp

memory/4692-49-0x00000000020F0000-0x00000000020F1000-memory.dmp

memory/4692-48-0x00000000005B0000-0x00000000005B2000-memory.dmp

memory/512-30-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-35-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-31-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-91-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-92-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-93-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-94-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-95-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-97-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-98-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-99-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-101-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-103-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/1608-106-0x0000000002DB0000-0x0000000002DB2000-memory.dmp

memory/1608-105-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

memory/512-107-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-108-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-111-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-113-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-116-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-117-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-120-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-121-0x00000000007A0000-0x000000000182E000-memory.dmp

memory/512-143-0x0000000000400000-0x0000000000431000-memory.dmp

memory/512-144-0x00000000007A0000-0x000000000182E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 3a0f08ab39423066fe25e7c1f8d8f5c6
SHA1 198fd8cca5855887de4c5f568b73e200aae57b65
SHA256 689a2c3f07fad39bea95516ab96a0e33c511d48d1a62983cdc492a35ed0a794f
SHA512 a2c7e2ede769a7e9625a64b75a0f7f53ef015ce3087b93b62964383bd70860cbafe1164cac0ce69a34c5ce443e7aa0603054fc7406bcf9d30bed8ac2d6082371

memory/4336-163-0x00000000005D0000-0x00000000005D2000-memory.dmp

C:\gvtw.pif

MD5 684beab22c2271dc6e215823ee095bee
SHA1 e703cb2b4c586681ffc22c4e5322b0ae4568440c
SHA256 21e0f15debdf120eec86d06b2d7e4da5e6a4dcdec36160b2ecb67a0563e63803
SHA512 857e11c93cfc4a8a751089c7f7535c7f7d6a1f5e8973117e081c6b57e48604a71812fdd793600bbbd9f98b79fc165a6e10cd2626ce8d23d8cc234adb8a14e0c1