Malware Analysis Report

2024-09-11 12:21

Sample ID 240615-zfvkvatbpg
Target 3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3
SHA256 3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3

Threat Level: Known bad

The file 3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Sality

Modifies firewall policy service

Modifies WinLogon for persistence

Windows security bypass

UAC bypass

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

UPX dump on OEP (original entry point)

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Windows security modification

UPX packed file

Enumerates connected drives

Modifies WinLogon

Checks whether UAC is enabled

Adds Run key to start application

Drops file in System32 directory

Drops autorun.inf file

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of WriteProcessMemory

System policy modification

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 20:40

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 20:40

Reported

2024-06-15 20:42

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe"

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2064 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2064 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2064 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2064 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe

"C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 204

Network

N/A

Files

memory/2064-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 20:40

Reported

2024-06-15 20:42

Platform

win10v2004-20240508-en

Max time kernel

121s

Max time network

151s

Command Line

"fontdrvhost.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe rundll.exe" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Disables Task Manager via registry modification

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\regsvr.exe" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\system = "Winhelp.exe" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\winhelp.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Windows\SysWOW64\winhelp.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Windows\SysWOW64\setup.ini C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File created C:\Windows\SysWOW64\regsvr.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Windows\SysWOW64\regsvr.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\regsvr.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File created C:\Windows\e57495d C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File created C:\Windows\winhelp.ini C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File opened for modification C:\Windows\winhelp.ini C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
File created C:\Windows\regsvr.exe C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2300 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\dwm.exe
PID 2300 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\sihost.exe
PID 2300 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\taskhostw.exe
PID 2300 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\Explorer.EXE
PID 2300 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\DllHost.exe
PID 2300 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2300 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2300 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2300 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2300 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 1516 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 1516 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 1516 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2300 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 2300 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2040 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2040 wrote to memory of 3880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 2300 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\dwm.exe
PID 2300 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\sihost.exe
PID 2300 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\taskhostw.exe
PID 2300 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\Explorer.EXE
PID 2300 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\DllHost.exe
PID 2300 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2300 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2300 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2300 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2300 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe
PID 2300 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\dwm.exe
PID 2300 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\sihost.exe
PID 2300 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\taskhostw.exe
PID 2300 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\Explorer.EXE
PID 2300 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\svchost.exe
PID 2300 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\DllHost.exe
PID 2300 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2300 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2300 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2300 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\System32\RuntimeBroker.exe
PID 2300 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe C:\Windows\system32\fontdrvhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe

"C:\Users\Admin\AppData\Local\Temp\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /C AT /delete /yes

C:\Windows\SysWOW64\at.exe

AT /delete /yes

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\at.exe

AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.crackspider.net udp
US 8.8.8.8:53 www.crackspider.net udp

Files

memory/2300-0-0x0000000000400000-0x00000000004B3000-memory.dmp

memory/2300-1-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-3-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-4-0x0000000003040000-0x00000000040FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E574A96_Rar\3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3.exe

MD5 a18b755297c7ae6c15c287d734f69838
SHA1 2f464bf4f96f61fc39079a6988f6891f8f77c1c9
SHA256 f7c85a45ab49471063ee03ab635c841d24a58217f921804ae1d11207f6278112
SHA512 b953f3542aee875e1e9101340f66a05180bda14a6be758cc4f8bc4f9455f296822ca415c5be737ae35f51a2a031e6ab8bbefdcaf37c56ca828af89b07899b371

memory/2300-30-0x0000000006590000-0x0000000006592000-memory.dmp

memory/2300-16-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-32-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-51-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-52-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-50-0x0000000006590000-0x0000000006592000-memory.dmp

memory/2300-31-0x00000000069E0000-0x00000000069E1000-memory.dmp

C:\Windows\SysWOW64\winhelp.exe

MD5 c8af751d681bfa0fe2e88b3fea083c61
SHA1 40c9f523d3b36129ae68bce0960226db56954320
SHA256 3c5fb10c4b8bb1b9cff2fdb01bea4747fcf9b6827288c0573ffb450c8906d1e3
SHA512 b79d37c3e14c441ed781aa74591b9129bdf9a75fd9ac9feda078f4cee8c2faa2713485659c6428e5eed7f519fd8747193098ad9e5db9490f298adf56edcf3b25

memory/2300-6-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-49-0x0000000006590000-0x0000000006592000-memory.dmp

memory/2300-5-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-7-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-53-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-54-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-55-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-56-0x0000000003040000-0x00000000040FA000-memory.dmp

C:\Windows\SysWOW64\setup.ini

MD5 9ece103c47335f0cc777f1132b8d522f
SHA1 63afa171c64f86d99db81723e1335e960e85fa43
SHA256 69815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
SHA512 b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05

memory/2300-61-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-63-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-65-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-66-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-67-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-68-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-71-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-73-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-74-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-76-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-78-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-80-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-81-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-82-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-85-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-87-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-89-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-90-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-92-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-94-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-102-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-104-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-106-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-108-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-109-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-110-0x0000000003040000-0x00000000040FA000-memory.dmp

memory/2300-112-0x0000000006590000-0x0000000006592000-memory.dmp

memory/2300-115-0x0000000003040000-0x00000000040FA000-memory.dmp

C:\pldoo.pif

MD5 deb72335b9ac2763e144912df91bd69c
SHA1 19e61e499dc1648921200d6fe3585018eaa23ca3
SHA256 f64c9bfb2f72ab6b4dd0b701eb232ad4e459a97144f46e6281aadde908dddd4f
SHA512 0085dc7fb30355564d0cbc3eecb9933c46bc67032bf8d3c7e38be1c9f7033964b499fa896348436eba608c8ada7667614d687b90146ba6c3a737e4bd98a02340