Malware Analysis Report

2024-09-11 10:26

Sample ID 240616-lrx88asekk
Target 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
Tags
4b955f amadey xmrig b2c2c1 evasion execution miner persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

Threat Level: Known bad

The file 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77 was found to be: Known bad.

Malicious Activity Summary

4b955f amadey xmrig b2c2c1 evasion execution miner persistence trojan upx

xmrig

Amadey

Amadey family

XMRig Miner payload

Creates new service(s)

Downloads MZ/PE file

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Checks computer location settings

UPX packed file

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Service Stop
T1489
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 09:46

Signatures

Amadey family

amadey

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 09:46

Reported

2024-06-16 09:49

Platform

win11-20240611-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1120 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
PID 1120 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
PID 1120 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Processes

C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe

"C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe"

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

Network

Country Destination Domain Proto
DE 185.172.128.116:80 185.172.128.116 tcp
US 8.8.8.8:53 116.128.172.185.in-addr.arpa udp
US 52.111.227.11:443 tcp

Files

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

MD5 07101cac5b9477ba636cd8ca7b9932cb
SHA1 59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1
SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA512 02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 09:46

Reported

2024-06-16 09:49

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe"

Signatures

Amadey

trojan amadey

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Downloads MZ/PE file

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2680 set thread context of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 set thread context of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Dctooux.job C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2312 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
PID 2312 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
PID 2312 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
PID 1568 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
PID 1568 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
PID 1568 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe
PID 1568 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe
PID 1568 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe
PID 1508 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 1508 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 1508 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe
PID 2324 wrote to memory of 4944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2324 wrote to memory of 4944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4400 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4400 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 2748 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\system32\conhost.exe
PID 2680 wrote to memory of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe
PID 2680 wrote to memory of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe
PID 2680 wrote to memory of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe
PID 2680 wrote to memory of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe
PID 2680 wrote to memory of 1916 N/A C:\ProgramData\wikombernizc\reakuqnanrkn.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe

"C:\Users\Admin\AppData\Local\Temp\488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77.exe"

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe

"C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 904

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 928

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1236

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1508 -ip 1508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 936

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 976

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 1408

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3192 -ip 3192

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 444

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "WSNKISKT"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "WSNKISKT"

C:\ProgramData\wikombernizc\reakuqnanrkn.exe

C:\ProgramData\wikombernizc\reakuqnanrkn.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3900 -ip 3900

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 900

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 440

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
DE 185.172.128.116:80 185.172.128.116 tcp
US 8.8.8.8:53 116.128.172.185.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 osdhs.in.ne udp
US 8.8.8.8:53 jkshb.su udp
US 8.8.8.8:53 greendag.ru udp
KR 123.213.233.131:80 jkshb.su tcp
KR 123.213.233.131:80 jkshb.su tcp
KR 123.213.233.131:80 jkshb.su tcp
US 8.8.8.8:53 131.233.213.123.in-addr.arpa udp
US 8.8.8.8:53 osdhs.in.ne udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 zeph-eu2.nanopool.org udp
NL 51.15.89.13:10943 zeph-eu2.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 13.89.15.51.in-addr.arpa udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
NL 51.15.65.182:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 182.65.15.51.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe

MD5 07101cac5b9477ba636cd8ca7b9932cb
SHA1 59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1
SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
SHA512 02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

C:\Users\Admin\AppData\Local\Temp\1000001001\b2c2c1.exe

MD5 f8ec725e4b969f157fd70166e73a56a3
SHA1 8bc092817245f2727154454e0011a8d6704e2eb7
SHA256 eb74efaf4832a80809815051fc97704819fbc4b1d57f07faf39746a02ed1dd10
SHA512 7dc3acb485263fd616ea84999a897f0e298f21485a34457697c523a095083d7de599b3cfc4bc3d45a5d36bc374a3a5e8778646dfa97c447d4be710021678e040

C:\Users\Admin\AppData\Local\Temp\1000002001\FirstZ.exe

MD5 ffada57f998ed6a72b6ba2f072d2690a
SHA1 6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256 677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA512 1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

memory/1508-48-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/1508-49-0x00000000020F0000-0x000000000215B000-memory.dmp

memory/1508-50-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1508-67-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1508-66-0x00000000020F0000-0x000000000215B000-memory.dmp

memory/1508-65-0x0000000000400000-0x0000000000481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\204450073126

MD5 c05d2b16c61740cdd6436604001f0edb
SHA1 8ab86963afa3c27a652d5ba38ec260800ee5fbbc
SHA256 62ab11026b30472e8de1e369923553ce1dabb2f36d42ca179bba9d7f751eca3e
SHA512 2f18f877ddf1ac57ded4890aa1da994b25a1f326a4424b0beeef9d703abbda1e670a4391add4f77af5a3f86612c835f217c7b7bb895595da8c57ee6613f74f1f

memory/3476-86-0x0000000000400000-0x0000000000481000-memory.dmp

memory/3192-88-0x0000000000400000-0x0000000000481000-memory.dmp

memory/2564-95-0x0000024E9DE00000-0x0000024E9DE22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2nhe2ek.ycx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3096-123-0x0000021522080000-0x000002152209C000-memory.dmp

memory/3096-124-0x00000215220A0000-0x0000021522155000-memory.dmp

memory/3096-125-0x0000021522160000-0x000002152216A000-memory.dmp

memory/3096-126-0x00000215222D0000-0x00000215222EC000-memory.dmp

memory/3096-127-0x00000215222B0000-0x00000215222BA000-memory.dmp

memory/3096-128-0x0000021522310000-0x000002152232A000-memory.dmp

memory/3096-129-0x00000215222C0000-0x00000215222C8000-memory.dmp

memory/3096-130-0x00000215222F0000-0x00000215222F6000-memory.dmp

memory/3096-131-0x0000021522300000-0x000002152230A000-memory.dmp

memory/2748-138-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2748-137-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2748-136-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2748-134-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2748-135-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2748-141-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1916-142-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-145-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-149-0x0000000001200000-0x0000000001220000-memory.dmp

memory/1916-147-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-153-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-151-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-152-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-150-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-146-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-144-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-143-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-148-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-154-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-155-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1916-156-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3900-165-0x0000000000400000-0x0000000000481000-memory.dmp

memory/1244-175-0x0000000000400000-0x0000000000481000-memory.dmp