Malware Analysis Report

2024-07-28 11:22

Sample ID 240614-aba8zazgpq
Target dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68
SHA256 dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68
Tags
collection evasion execution spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68

Threat Level: Known bad

The file dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68 was found to be: Known bad.

Malicious Activity Summary

collection evasion execution spyware

Modifies visibility of file extensions in Explorer

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Accesses Microsoft Outlook accounts

Accesses cryptocurrency files/wallets, possible credential harvesting

Enumerates connected drives

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

outlook_win_path

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Email Collection
T1114
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:01

Reported

2024-06-14 00:06

Platform

win7-20240221-en

Max time kernel

298s

Max time network

298s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\H: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Q: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\N: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\R: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\U: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\W: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Z: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\A: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\M: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\G: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\J: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\K: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\O: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\S: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\T: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\B: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\E: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\X: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\P: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Y: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\I: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\L: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2452 set thread context of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 set thread context of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2440 set thread context of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2452 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2440 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2260 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 2936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe

"C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
NL 206.188.197.206:443 tcp
US 144.172.74.112:443 tcp
RU 45.142.122.192:47398 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp

Files

memory/2452-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/2452-1-0x0000000000230000-0x00000000007C0000-memory.dmp

memory/2452-2-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2452-3-0x00000000059C0000-0x0000000005A04000-memory.dmp

memory/2452-4-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/2452-5-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2452-6-0x0000000004470000-0x000000000448A000-memory.dmp

memory/2452-7-0x00000000044A0000-0x00000000044A6000-memory.dmp

memory/2452-8-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2440-9-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-11-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-15-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2440-13-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2452-18-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2440-19-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-21-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-23-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2440-24-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2440-25-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2260-26-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-30-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-34-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-38-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-28-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-32-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-36-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-44-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-42-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-40-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2440-57-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2044-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2044-54-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2044-51-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2044-49-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2044-48-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2440-58-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2440-59-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2260-60-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-61-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-62-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2452-63-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2260-64-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2260-65-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-67-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/2260-66-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/2260-71-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-72-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-73-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-70-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-68-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-74-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2044-75-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2440-78-0x00000000744C0000-0x0000000074BAE000-memory.dmp

memory/2044-77-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2044-76-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2260-81-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-82-0x00000000029B0000-0x0000000002ED1000-memory.dmp

memory/2260-83-0x00000000029B0000-0x0000000002ED1000-memory.dmp

\Program Files\Mozilla Firefox\firefox.exe

MD5 1fd347ee17287e9c9532c46a49c4abc4
SHA1 ad5d9599030bfbcc828c4321fffd7b9066369393
SHA256 912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237
SHA512 9e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4

C:\Users\Admin\AppData\Local\Temp\Rrerhsoi

MD5 b13fcb3223116f6eec60be9143cae98b
SHA1 9a9eb6da6d8e008a51e6ce6212c49bfbe7cb3c88
SHA256 961fc9bf866c5b58401d3c91735f9a7b7b4fc93c94038c504c965491f622b52b
SHA512 89d72b893acd2ec537b3c3deffcc71d1ce02211f9f5b931c561625ee7162052b511e46d4b4596c0a715e1c992310f2536ebdd512db400eeab23c8960ec4d312d

memory/2260-142-0x0000000000400000-0x0000000000798000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:01

Reported

2024-06-14 00:06

Platform

win10-20240404-en

Max time kernel

299s

Max time network

300s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook accounts

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\I: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\J: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\K: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\L: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\O: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\R: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\U: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\V: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Y: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\B: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\E: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\H: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\N: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\T: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\X: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Z: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\G: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\M: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\P: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\Q: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\S: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened (read-only) \??\W: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2908 set thread context of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 set thread context of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4160 set thread context of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 2908 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4160 wrote to memory of 596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 2332 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2332 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2332 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe

"C:\Users\Admin\AppData\Local\Temp\dfe4ef2a64994387cd195d13c7fb123e53e7741a16a09a5d32d74ef16f032e68.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
NL 206.188.197.206:443 tcp
US 8.8.8.8:53 206.197.188.206.in-addr.arpa udp
US 144.172.74.112:443 tcp
RU 45.142.122.192:47398 tcp
US 8.8.8.8:53 192.122.142.45.in-addr.arpa udp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp
US 144.172.74.112:443 tcp

Files

memory/2908-0-0x0000000073ADE000-0x0000000073ADF000-memory.dmp

memory/2908-1-0x0000000000FB0000-0x0000000001540000-memory.dmp

memory/2908-2-0x0000000005370000-0x000000000586E000-memory.dmp

memory/2908-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

memory/2908-4-0x0000000004F10000-0x0000000004FAC000-memory.dmp

memory/2908-5-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2908-6-0x0000000005E30000-0x0000000005E74000-memory.dmp

memory/2908-7-0x00000000060C0000-0x00000000060CA000-memory.dmp

memory/2908-8-0x0000000073ADE000-0x0000000073ADF000-memory.dmp

memory/2908-9-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2908-10-0x0000000000E80000-0x0000000000E9A000-memory.dmp

memory/2908-11-0x0000000000EB0000-0x0000000000EB6000-memory.dmp

memory/4160-12-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/4160-13-0x0000000000400000-0x00000000004C0000-memory.dmp

memory/2908-14-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/4160-15-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/4160-16-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/4160-17-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2908-18-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/4160-19-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/4160-20-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2332-21-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2332-22-0x0000000000400000-0x0000000000798000-memory.dmp

memory/2908-24-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2332-25-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-27-0x000000006E600000-0x000000006E69D000-memory.dmp

memory/2332-26-0x0000000063280000-0x00000000634BE000-memory.dmp

memory/2332-31-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-32-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-33-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-30-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-28-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/596-34-0x0000000000400000-0x0000000000466000-memory.dmp

memory/4160-36-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2332-37-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/596-38-0x0000000008A20000-0x0000000009026000-memory.dmp

memory/596-39-0x00000000085B0000-0x00000000086BA000-memory.dmp

memory/596-40-0x00000000084F0000-0x0000000008502000-memory.dmp

memory/596-41-0x0000000008550000-0x000000000858E000-memory.dmp

memory/596-42-0x00000000086C0000-0x000000000870B000-memory.dmp

memory/3420-45-0x00000000070F0000-0x0000000007126000-memory.dmp

memory/3420-46-0x0000000007760000-0x0000000007D88000-memory.dmp

memory/2332-47-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-48-0x0000000007E30000-0x0000000007E52000-memory.dmp

memory/2332-49-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-56-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-59-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-60-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-57-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-58-0x00000000081B0000-0x0000000008500000-memory.dmp

memory/2332-55-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-54-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-51-0x0000000008120000-0x0000000008186000-memory.dmp

memory/3420-50-0x0000000007ED0000-0x0000000007F36000-memory.dmp

memory/2332-53-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-52-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-61-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-62-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-63-0x0000000008000000-0x000000000801C000-memory.dmp

memory/2332-65-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-66-0x0000000008910000-0x0000000008986000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzq1u3nk.zlo.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Users\Admin\AppData\Local\Temp\Hpuydoh

MD5 b13fcb3223116f6eec60be9143cae98b
SHA1 9a9eb6da6d8e008a51e6ce6212c49bfbe7cb3c88
SHA256 961fc9bf866c5b58401d3c91735f9a7b7b4fc93c94038c504c965491f622b52b
SHA512 89d72b893acd2ec537b3c3deffcc71d1ce02211f9f5b931c561625ee7162052b511e46d4b4596c0a715e1c992310f2536ebdd512db400eeab23c8960ec4d312d

memory/596-96-0x00000000089C0000-0x00000000089DE000-memory.dmp

memory/3420-101-0x0000000009770000-0x00000000097A3000-memory.dmp

memory/3420-102-0x0000000070730000-0x000000007077B000-memory.dmp

memory/596-104-0x000000000A030000-0x000000000A1F2000-memory.dmp

memory/596-109-0x000000000A730000-0x000000000AC5C000-memory.dmp

memory/3420-110-0x00000000098B0000-0x0000000009955000-memory.dmp

memory/3420-103-0x0000000009750000-0x000000000976E000-memory.dmp

memory/2332-113-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-115-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-114-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-116-0x0000000009C90000-0x0000000009D24000-memory.dmp

memory/2332-112-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-111-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/2332-188-0x0000000002E80000-0x00000000033A1000-memory.dmp

memory/3420-320-0x0000000009C30000-0x0000000009C4A000-memory.dmp

memory/3420-325-0x0000000009C20000-0x0000000009C28000-memory.dmp

memory/2332-341-0x0000000004910000-0x00000000049D0000-memory.dmp