Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
0506f2c306f1eb3760e3931573bda550N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0506f2c306f1eb3760e3931573bda550N.exe
Resource
win10v2004-20240709-en
General
-
Target
0506f2c306f1eb3760e3931573bda550N.exe
-
Size
208KB
-
MD5
0506f2c306f1eb3760e3931573bda550
-
SHA1
f16af8370c4ee038d839b5dbe7baaa61edc3d8bb
-
SHA256
81b02e400c3f13cf7a0d225fb7606239cef329fbf78adb9050b25ce36f6356f1
-
SHA512
dcc95e89c9df99376a3a5186642fb7072a0173c8995151ab31a30a4f7c5cd374effd969b73ce09be209f17eeaa0370b468d128eaac8b40e9e905bda7d9588ba3
-
SSDEEP
6144:7AS6gyCdizgZu8u/yVfkbf+efjnnuI66RNQEj:7A9CdizgZu8u/b7+efjnnu16RNQ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation MBQ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation KMJMHQT.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation CLLMNF.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation OTAVJIA.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation YHEVQ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ZNSCHC.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation QSCIZ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation CZDGZ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation IIW.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation OVDZYPM.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation PLGMSA.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation EBNJCP.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation NRBMP.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation XRAA.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation AEJFSIV.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation URYNELN.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation UJTRN.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SSA.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation DYKEMY.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SLJH.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation XIP.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WBSHKB.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation DCBN.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SEI.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation TMAAZNV.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ZHSQS.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation HQOYPDR.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation DCTVB.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation LOG.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ZXIZK.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WGNN.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation LZB.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SFD.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation RVTWXUL.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation FHNL.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation CKEFAY.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation PFTLVG.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation XVEF.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation TFQHJT.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation BNAIW.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation CFXT.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation JHKBYU.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation NYCXMVW.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation UHMWND.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ARW.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ERFDD.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SWVZ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation AUUEA.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation PXALNZF.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation UVVB.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation RZO.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation EEX.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation MEK.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation UYZ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SXQOQFC.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation DDBC.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WUYGEY.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation ARUZXDJ.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation LVGI.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation SHYERL.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation HHMUCE.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WSK.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation LOQNQB.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation OSCFPCH.exe -
Executes dropped EXE 64 IoCs
pid Process 2628 PQREJS.exe 3404 BTB.exe 4632 BMK.exe 2564 ZWNJGPF.exe 1464 IPLXONV.exe 3780 QAURCRJ.exe 4884 NAVTGW.exe 5012 ALMSUY.exe 636 QBNRBUD.exe 3528 UJTRN.exe 2100 OXYBYMN.exe 3848 YUEVFM.exe 1352 ZXIZK.exe 3800 DFOZXVM.exe 3780 MOQE.exe 3628 LZB.exe 3424 HELJZJ.exe 1076 DCTVB.exe 1092 SFD.exe 604 QSCIZ.exe 3784 WSK.exe 3816 FBEB.exe 336 SEI.exe 1660 IHRMJO.exe 1436 EEX.exe 4172 JPTHVPQ.exe 3352 RVTWXUL.exe 3948 MIYF.exe 1108 SIFTQW.exe 3000 MEK.exe 336 AGTBPH.exe 4596 UCX.exe 3004 TMAAZNV.exe 4712 UHMWND.exe 3248 RIM.exe 4876 QAXAF.exe 4448 NYCXMVW.exe 336 NBGS.exe 3936 ERFDD.exe 2944 PJIWL.exe 4660 PXALNZF.exe 4452 KKFU.exe 492 DDUFGRC.exe 3116 NBAROAL.exe 2212 EQHCAT.exe 3228 WUYGEY.exe 448 FHJYUUP.exe 1552 CEOV.exe 3660 NXJNB.exe 1476 KDPDQ.exe 4144 XIP.exe 2792 BQEWE.exe 3708 OTAVJIA.exe 1768 LZGSQS.exe 3352 UHIXU.exe 4232 JCRJNKF.exe 2628 ZSSB.exe 3076 TFXKWY.exe 2496 IAG.exe 4592 PWGXLV.exe 3624 JJK.exe 2928 SWVZ.exe 3000 KFXEPPM.exe 4896 XHFCD.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VRO.exe.bat VDOZXUZ.exe File created C:\windows\SysWOW64\WBSHKB.exe.bat MBQ.exe File created C:\windows\SysWOW64\ERFDD.exe NBGS.exe File opened for modification C:\windows\SysWOW64\CZDGZ.exe RHANRN.exe File created C:\windows\SysWOW64\WJJB.exe HTI.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat IASBSC.exe File opened for modification C:\windows\SysWOW64\IPLXONV.exe ZWNJGPF.exe File opened for modification C:\windows\SysWOW64\ERFDD.exe NBGS.exe File created C:\windows\SysWOW64\NGF.exe.bat AEJFSIV.exe File created C:\windows\SysWOW64\AAH.exe.bat JKA.exe File created C:\windows\SysWOW64\KUSIJ.exe.bat RZO.exe File created C:\windows\SysWOW64\BMAFVZF.exe MWZG.exe File created C:\windows\SysWOW64\BMAFVZF.exe.bat MWZG.exe File created C:\windows\SysWOW64\WGNN.exe AAH.exe File created C:\windows\SysWOW64\XJEAYG.exe.bat OJCV.exe File created C:\windows\SysWOW64\ALMSUY.exe.bat NAVTGW.exe File opened for modification C:\windows\SysWOW64\UJTRN.exe QBNRBUD.exe File created C:\windows\SysWOW64\WJJB.exe.bat HTI.exe File opened for modification C:\windows\SysWOW64\RCIR.exe YHEVQ.exe File created C:\windows\SysWOW64\BTB.exe PQREJS.exe File created C:\windows\SysWOW64\TPNIG.exe RCIR.exe File created C:\windows\SysWOW64\NVW.exe.bat KIRNZJ.exe File created C:\windows\SysWOW64\COPQB.exe.bat CLLMNF.exe File created C:\windows\SysWOW64\VRO.exe VDOZXUZ.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe WBSHKB.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe DCBN.exe File created C:\windows\SysWOW64\TMAAZNV.exe UCX.exe File created C:\windows\SysWOW64\FHJYUUP.exe WUYGEY.exe File opened for modification C:\windows\SysWOW64\FHJYUUP.exe WUYGEY.exe File created C:\windows\SysWOW64\VDOZXUZ.exe IASBSC.exe File opened for modification C:\windows\SysWOW64\PQREJS.exe 0506f2c306f1eb3760e3931573bda550N.exe File opened for modification C:\windows\SysWOW64\RZO.exe GGLMWEY.exe File created C:\windows\SysWOW64\KHAJ.exe SHYERL.exe File created C:\windows\SysWOW64\COXA.exe.bat ARW.exe File created C:\windows\SysWOW64\KHAJ.exe.bat SHYERL.exe File created C:\windows\SysWOW64\NBAROAL.exe DDUFGRC.exe File created C:\windows\SysWOW64\IAMSKB.exe.bat AUUEA.exe File created C:\windows\SysWOW64\KLMKL.exe.bat GDGKY.exe File created C:\windows\SysWOW64\COXA.exe ARW.exe File opened for modification C:\windows\SysWOW64\EBNJCP.exe SIKQ.exe File opened for modification C:\windows\SysWOW64\WGNN.exe AAH.exe File created C:\windows\SysWOW64\CWLXPA.exe.bat AGKVJL.exe File opened for modification C:\windows\SysWOW64\BTB.exe PQREJS.exe File created C:\windows\SysWOW64\PWGXLV.exe.bat IAG.exe File created C:\windows\SysWOW64\SXQOQFC.exe.bat RUM.exe File created C:\windows\SysWOW64\RZO.exe.bat GGLMWEY.exe File opened for modification C:\windows\SysWOW64\EEX.exe IHRMJO.exe File created C:\windows\SysWOW64\EEX.exe.bat IHRMJO.exe File created C:\windows\SysWOW64\TMAAZNV.exe.bat UCX.exe File created C:\windows\SysWOW64\PWGXLV.exe IAG.exe File opened for modification C:\windows\SysWOW64\LOG.exe UYZ.exe File created C:\windows\SysWOW64\VHWLFB.exe HWG.exe File created C:\windows\SysWOW64\NVW.exe KIRNZJ.exe File opened for modification C:\windows\SysWOW64\LZB.exe MOQE.exe File created C:\windows\SysWOW64\FBEB.exe.bat WSK.exe File created C:\windows\SysWOW64\ZSSB.exe JCRJNKF.exe File opened for modification C:\windows\SysWOW64\SXQOQFC.exe RUM.exe File opened for modification C:\windows\SysWOW64\IAMSKB.exe AUUEA.exe File created C:\windows\SysWOW64\QIIKZG.exe ASHLSSU.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe MBQ.exe File created C:\windows\SysWOW64\IPLXONV.exe ZWNJGPF.exe File created C:\windows\SysWOW64\UJTRN.exe.bat QBNRBUD.exe File created C:\windows\SysWOW64\LZB.exe MOQE.exe File created C:\windows\SysWOW64\IAG.exe TFXKWY.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\XRAA.exe JHKBYU.exe File created C:\windows\IIW.exe PFTLVG.exe File created C:\windows\ZWNJGPF.exe.bat BMK.exe File opened for modification C:\windows\SSA.exe SNACP.exe File created C:\windows\JMUG.exe YUR.exe File opened for modification C:\windows\CNDH.exe DYKEMY.exe File opened for modification C:\windows\PXALNZF.exe PJIWL.exe File created C:\windows\RHJJG.exe.bat BMAFVZF.exe File opened for modification C:\windows\system\SWVZ.exe JJK.exe File created C:\windows\system\IASBSC.exe.bat TVMEDT.exe File opened for modification C:\windows\MWZG.exe VRO.exe File created C:\windows\YUR.exe.bat QBJUWK.exe File opened for modification C:\windows\PTBQQRQ.exe NVW.exe File created C:\windows\system\NRBMP.exe JJU.exe File created C:\windows\system\WSK.exe.bat QSCIZ.exe File opened for modification C:\windows\system\TFXKWY.exe ZSSB.exe File created C:\windows\system\QBJUWK.exe.bat CWLXPA.exe File created C:\windows\system\DFOZXVM.exe.bat ZXIZK.exe File created C:\windows\UKFQVAW.exe.bat FHNL.exe File opened for modification C:\windows\system\DDEDID.exe XHFCD.exe File created C:\windows\AEJFSIV.exe PLGMSA.exe File created C:\windows\system\JJU.exe COXA.exe File opened for modification C:\windows\IJUIDHZ.exe CNDH.exe File created C:\windows\system\TFXKWY.exe.bat ZSSB.exe File opened for modification C:\windows\DDBC.exe ZVUUYI.exe File opened for modification C:\windows\RVTWXUL.exe JPTHVPQ.exe File created C:\windows\HWG.exe.bat HQOYPDR.exe File created C:\windows\system\WSK.exe QSCIZ.exe File created C:\windows\system\OVDZYPM.exe.bat CNWZT.exe File opened for modification C:\windows\HHMUCE.exe OEIYXOG.exe File created C:\windows\system\BTIVLGC.exe.bat TFQHJT.exe File created C:\windows\FZDB.exe NVMY.exe File opened for modification C:\windows\system\NAVTGW.exe QAURCRJ.exe File created C:\windows\system\NAVTGW.exe.bat QAURCRJ.exe File created C:\windows\KKFU.exe.bat PXALNZF.exe File created C:\windows\system\BQEWE.exe.bat XIP.exe File opened for modification C:\windows\system\BMK.exe BTB.exe File opened for modification C:\windows\DCBN.exe XBUZDV.exe File opened for modification C:\windows\system\WUYGEY.exe EQHCAT.exe File created C:\windows\system\SIKQ.exe SFHMPSC.exe File created C:\windows\system\YSLQ.exe UKFQVAW.exe File opened for modification C:\windows\system\BTIVLGC.exe TFQHJT.exe File opened for modification C:\windows\ZNSCHC.exe QIIKZG.exe File created C:\windows\system\FBV.exe LOQNQB.exe File opened for modification C:\windows\system\UVVB.exe SXQOQFC.exe File created C:\windows\system\RHANRN.exe HGYINQJ.exe File created C:\windows\system\TVMEDT.exe EADZ.exe File opened for modification C:\windows\ZWHZHFC.exe EJCQX.exe File created C:\windows\DCBN.exe.bat XBUZDV.exe File opened for modification C:\windows\system\DCTVB.exe HELJZJ.exe File created C:\windows\system\QAXAF.exe RIM.exe File created C:\windows\XBUZDV.exe COPQB.exe File created C:\windows\system\OEIYXOG.exe.bat CWBQK.exe File created C:\windows\system\YUEVFM.exe OXYBYMN.exe File created C:\windows\EQHCAT.exe NBAROAL.exe File created C:\windows\system\SWVZ.exe JJK.exe File created C:\windows\ZNSCHC.exe.bat QIIKZG.exe File created C:\windows\system\ZVUUYI.exe.bat XXT.exe File created C:\windows\UHMWND.exe TMAAZNV.exe File created C:\windows\UYZ.exe.bat UVVB.exe File opened for modification C:\windows\system\CLLMNF.exe SLJH.exe File opened for modification C:\windows\system\DFOZXVM.exe ZXIZK.exe File created C:\windows\SSA.exe SNACP.exe File created C:\windows\system\YNE.exe.bat EAZQVD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 5096 2824 WerFault.exe 85 4560 2628 WerFault.exe 94 3316 3404 WerFault.exe 100 1980 4632 WerFault.exe 105 4064 2564 WerFault.exe 110 4812 1464 WerFault.exe 115 4504 3780 WerFault.exe 120 3812 4884 WerFault.exe 125 1096 5012 WerFault.exe 130 1912 636 WerFault.exe 135 5008 3528 WerFault.exe 140 1980 2100 WerFault.exe 145 4020 3848 WerFault.exe 150 4752 1352 WerFault.exe 155 5036 3800 WerFault.exe 159 1320 3780 WerFault.exe 165 1964 3628 WerFault.exe 170 4852 3424 WerFault.exe 175 4696 1076 WerFault.exe 180 1696 1092 WerFault.exe 185 2308 604 WerFault.exe 190 1680 3784 WerFault.exe 195 2732 3816 WerFault.exe 200 4868 336 WerFault.exe 207 4736 1660 WerFault.exe 213 1224 1436 WerFault.exe 219 2728 4172 WerFault.exe 224 2308 3352 WerFault.exe 229 1680 3948 WerFault.exe 234 2600 1108 WerFault.exe 240 3412 3000 WerFault.exe 245 3864 336 WerFault.exe 250 4144 4596 WerFault.exe 255 4020 3004 WerFault.exe 261 2624 4712 WerFault.exe 266 4984 3248 WerFault.exe 271 4232 4876 WerFault.exe 276 1912 4448 WerFault.exe 282 4424 336 WerFault.exe 288 4120 3936 WerFault.exe 293 2400 2944 WerFault.exe 298 3248 4660 WerFault.exe 303 4876 4452 WerFault.exe 308 2092 492 WerFault.exe 313 4596 3116 WerFault.exe 318 820 2212 WerFault.exe 323 2344 3228 WerFault.exe 328 4488 448 WerFault.exe 333 3776 1552 WerFault.exe 338 1884 3660 WerFault.exe 343 1720 1476 WerFault.exe 348 4576 4144 WerFault.exe 354 3936 2792 WerFault.exe 359 2524 3708 WerFault.exe 364 1484 1768 WerFault.exe 369 4552 3352 WerFault.exe 374 2044 4232 WerFault.exe 379 2192 2628 WerFault.exe 384 2536 3076 WerFault.exe 389 4880 2496 WerFault.exe 394 4920 4592 WerFault.exe 399 2604 3624 WerFault.exe 404 1108 2928 WerFault.exe 409 4364 3000 WerFault.exe 414 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 0506f2c306f1eb3760e3931573bda550N.exe 2824 0506f2c306f1eb3760e3931573bda550N.exe 2628 PQREJS.exe 2628 PQREJS.exe 3404 BTB.exe 3404 BTB.exe 4632 BMK.exe 4632 BMK.exe 2564 ZWNJGPF.exe 2564 ZWNJGPF.exe 1464 IPLXONV.exe 1464 IPLXONV.exe 3780 QAURCRJ.exe 3780 QAURCRJ.exe 4884 NAVTGW.exe 4884 NAVTGW.exe 5012 ALMSUY.exe 5012 ALMSUY.exe 636 QBNRBUD.exe 636 QBNRBUD.exe 3528 UJTRN.exe 3528 UJTRN.exe 2100 OXYBYMN.exe 2100 OXYBYMN.exe 3848 YUEVFM.exe 3848 YUEVFM.exe 1352 ZXIZK.exe 1352 ZXIZK.exe 3800 DFOZXVM.exe 3800 DFOZXVM.exe 3780 MOQE.exe 3780 MOQE.exe 3628 LZB.exe 3628 LZB.exe 3424 HELJZJ.exe 3424 HELJZJ.exe 1076 DCTVB.exe 1076 DCTVB.exe 1092 SFD.exe 1092 SFD.exe 604 QSCIZ.exe 604 QSCIZ.exe 3784 WSK.exe 3784 WSK.exe 3816 FBEB.exe 3816 FBEB.exe 336 SEI.exe 336 SEI.exe 1660 IHRMJO.exe 1660 IHRMJO.exe 1436 EEX.exe 1436 EEX.exe 4172 JPTHVPQ.exe 4172 JPTHVPQ.exe 3352 RVTWXUL.exe 3352 RVTWXUL.exe 3948 MIYF.exe 3948 MIYF.exe 1108 SIFTQW.exe 1108 SIFTQW.exe 3000 MEK.exe 3000 MEK.exe 336 AGTBPH.exe 336 AGTBPH.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2824 0506f2c306f1eb3760e3931573bda550N.exe 2824 0506f2c306f1eb3760e3931573bda550N.exe 2628 PQREJS.exe 2628 PQREJS.exe 3404 BTB.exe 3404 BTB.exe 4632 BMK.exe 4632 BMK.exe 2564 ZWNJGPF.exe 2564 ZWNJGPF.exe 1464 IPLXONV.exe 1464 IPLXONV.exe 3780 QAURCRJ.exe 3780 QAURCRJ.exe 4884 NAVTGW.exe 4884 NAVTGW.exe 5012 ALMSUY.exe 5012 ALMSUY.exe 636 QBNRBUD.exe 636 QBNRBUD.exe 3528 UJTRN.exe 3528 UJTRN.exe 2100 OXYBYMN.exe 2100 OXYBYMN.exe 3848 YUEVFM.exe 3848 YUEVFM.exe 1352 ZXIZK.exe 1352 ZXIZK.exe 3800 DFOZXVM.exe 3800 DFOZXVM.exe 3780 MOQE.exe 3780 MOQE.exe 3628 LZB.exe 3628 LZB.exe 3424 HELJZJ.exe 3424 HELJZJ.exe 1076 DCTVB.exe 1076 DCTVB.exe 1092 SFD.exe 1092 SFD.exe 604 QSCIZ.exe 604 QSCIZ.exe 3784 WSK.exe 3784 WSK.exe 3816 FBEB.exe 3816 FBEB.exe 336 SEI.exe 336 SEI.exe 1660 IHRMJO.exe 1660 IHRMJO.exe 1436 EEX.exe 1436 EEX.exe 4172 JPTHVPQ.exe 4172 JPTHVPQ.exe 3352 RVTWXUL.exe 3352 RVTWXUL.exe 3948 MIYF.exe 3948 MIYF.exe 1108 SIFTQW.exe 1108 SIFTQW.exe 3000 MEK.exe 3000 MEK.exe 336 AGTBPH.exe 336 AGTBPH.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 3628 2824 0506f2c306f1eb3760e3931573bda550N.exe 90 PID 2824 wrote to memory of 3628 2824 0506f2c306f1eb3760e3931573bda550N.exe 90 PID 2824 wrote to memory of 3628 2824 0506f2c306f1eb3760e3931573bda550N.exe 90 PID 3628 wrote to memory of 2628 3628 cmd.exe 94 PID 3628 wrote to memory of 2628 3628 cmd.exe 94 PID 3628 wrote to memory of 2628 3628 cmd.exe 94 PID 2628 wrote to memory of 3164 2628 PQREJS.exe 96 PID 2628 wrote to memory of 3164 2628 PQREJS.exe 96 PID 2628 wrote to memory of 3164 2628 PQREJS.exe 96 PID 3164 wrote to memory of 3404 3164 cmd.exe 100 PID 3164 wrote to memory of 3404 3164 cmd.exe 100 PID 3164 wrote to memory of 3404 3164 cmd.exe 100 PID 3404 wrote to memory of 4664 3404 BTB.exe 101 PID 3404 wrote to memory of 4664 3404 BTB.exe 101 PID 3404 wrote to memory of 4664 3404 BTB.exe 101 PID 4664 wrote to memory of 4632 4664 cmd.exe 105 PID 4664 wrote to memory of 4632 4664 cmd.exe 105 PID 4664 wrote to memory of 4632 4664 cmd.exe 105 PID 4632 wrote to memory of 4100 4632 BMK.exe 106 PID 4632 wrote to memory of 4100 4632 BMK.exe 106 PID 4632 wrote to memory of 4100 4632 BMK.exe 106 PID 4100 wrote to memory of 2564 4100 cmd.exe 110 PID 4100 wrote to memory of 2564 4100 cmd.exe 110 PID 4100 wrote to memory of 2564 4100 cmd.exe 110 PID 2564 wrote to memory of 2292 2564 ZWNJGPF.exe 111 PID 2564 wrote to memory of 2292 2564 ZWNJGPF.exe 111 PID 2564 wrote to memory of 2292 2564 ZWNJGPF.exe 111 PID 2292 wrote to memory of 1464 2292 cmd.exe 115 PID 2292 wrote to memory of 1464 2292 cmd.exe 115 PID 2292 wrote to memory of 1464 2292 cmd.exe 115 PID 1464 wrote to memory of 4580 1464 IPLXONV.exe 116 PID 1464 wrote to memory of 4580 1464 IPLXONV.exe 116 PID 1464 wrote to memory of 4580 1464 IPLXONV.exe 116 PID 4580 wrote to memory of 3780 4580 cmd.exe 120 PID 4580 wrote to memory of 3780 4580 cmd.exe 120 PID 4580 wrote to memory of 3780 4580 cmd.exe 120 PID 3780 wrote to memory of 2040 3780 QAURCRJ.exe 121 PID 3780 wrote to memory of 2040 3780 QAURCRJ.exe 121 PID 3780 wrote to memory of 2040 3780 QAURCRJ.exe 121 PID 2040 wrote to memory of 4884 2040 cmd.exe 125 PID 2040 wrote to memory of 4884 2040 cmd.exe 125 PID 2040 wrote to memory of 4884 2040 cmd.exe 125 PID 4884 wrote to memory of 116 4884 NAVTGW.exe 126 PID 4884 wrote to memory of 116 4884 NAVTGW.exe 126 PID 4884 wrote to memory of 116 4884 NAVTGW.exe 126 PID 116 wrote to memory of 5012 116 cmd.exe 130 PID 116 wrote to memory of 5012 116 cmd.exe 130 PID 116 wrote to memory of 5012 116 cmd.exe 130 PID 5012 wrote to memory of 2904 5012 ALMSUY.exe 131 PID 5012 wrote to memory of 2904 5012 ALMSUY.exe 131 PID 5012 wrote to memory of 2904 5012 ALMSUY.exe 131 PID 2904 wrote to memory of 636 2904 cmd.exe 135 PID 2904 wrote to memory of 636 2904 cmd.exe 135 PID 2904 wrote to memory of 636 2904 cmd.exe 135 PID 636 wrote to memory of 1472 636 QBNRBUD.exe 136 PID 636 wrote to memory of 1472 636 QBNRBUD.exe 136 PID 636 wrote to memory of 1472 636 QBNRBUD.exe 136 PID 1472 wrote to memory of 3528 1472 cmd.exe 140 PID 1472 wrote to memory of 3528 1472 cmd.exe 140 PID 1472 wrote to memory of 3528 1472 cmd.exe 140 PID 3528 wrote to memory of 2704 3528 UJTRN.exe 141 PID 3528 wrote to memory of 2704 3528 UJTRN.exe 141 PID 3528 wrote to memory of 2704 3528 UJTRN.exe 141 PID 2704 wrote to memory of 2100 2704 cmd.exe 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\0506f2c306f1eb3760e3931573bda550N.exe"C:\Users\Admin\AppData\Local\Temp\0506f2c306f1eb3760e3931573bda550N.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQREJS.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\PQREJS.exeC:\windows\system32\PQREJS.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BTB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\SysWOW64\BTB.exeC:\windows\system32\BTB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\system\BMK.exeC:\windows\system\BMK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWNJGPF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\ZWNJGPF.exeC:\windows\ZWNJGPF.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPLXONV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\windows\SysWOW64\IPLXONV.exeC:\windows\system32\IPLXONV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QAURCRJ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\QAURCRJ.exeC:\windows\system\QAURCRJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NAVTGW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\NAVTGW.exeC:\windows\system\NAVTGW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALMSUY.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\windows\SysWOW64\ALMSUY.exeC:\windows\system32\ALMSUY.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBNRBUD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\QBNRBUD.exeC:\windows\QBNRBUD.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJTRN.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\SysWOW64\UJTRN.exeC:\windows\system32\UJTRN.exe21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXYBYMN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\SysWOW64\OXYBYMN.exeC:\windows\system32\OXYBYMN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUEVFM.exe.bat" "24⤵PID:2728
-
C:\windows\system\YUEVFM.exeC:\windows\system\YUEVFM.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXIZK.exe.bat" "26⤵PID:3148
-
C:\windows\system\ZXIZK.exeC:\windows\system\ZXIZK.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DFOZXVM.exe.bat" "28⤵PID:2160
-
C:\windows\system\DFOZXVM.exeC:\windows\system\DFOZXVM.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MOQE.exe.bat" "30⤵PID:1476
-
C:\windows\system\MOQE.exeC:\windows\system\MOQE.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZB.exe.bat" "32⤵PID:3184
-
C:\windows\SysWOW64\LZB.exeC:\windows\system32\LZB.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HELJZJ.exe.bat" "34⤵PID:4596
-
C:\windows\system\HELJZJ.exeC:\windows\system\HELJZJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCTVB.exe.bat" "36⤵PID:2044
-
C:\windows\system\DCTVB.exeC:\windows\system\DCTVB.exe37⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFD.exe.bat" "38⤵PID:2940
-
C:\windows\system\SFD.exeC:\windows\system\SFD.exe39⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSCIZ.exe.bat" "40⤵PID:4728
-
C:\windows\SysWOW64\QSCIZ.exeC:\windows\system32\QSCIZ.exe41⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSK.exe.bat" "42⤵PID:3240
-
C:\windows\system\WSK.exeC:\windows\system\WSK.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBEB.exe.bat" "44⤵PID:2420
-
C:\windows\SysWOW64\FBEB.exeC:\windows\system32\FBEB.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEI.exe.bat" "46⤵PID:4640
-
C:\windows\system\SEI.exeC:\windows\system\SEI.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHRMJO.exe.bat" "48⤵PID:2748
-
C:\windows\IHRMJO.exeC:\windows\IHRMJO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EEX.exe.bat" "50⤵PID:1012
-
C:\windows\SysWOW64\EEX.exeC:\windows\system32\EEX.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JPTHVPQ.exe.bat" "52⤵PID:452
-
C:\windows\system\JPTHVPQ.exeC:\windows\system\JPTHVPQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVTWXUL.exe.bat" "54⤵PID:2212
-
C:\windows\RVTWXUL.exeC:\windows\RVTWXUL.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIYF.exe.bat" "56⤵PID:2920
-
C:\windows\system\MIYF.exeC:\windows\system\MIYF.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIFTQW.exe.bat" "58⤵PID:1060
-
C:\windows\SIFTQW.exeC:\windows\SIFTQW.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEK.exe.bat" "60⤵PID:1644
-
C:\windows\system\MEK.exeC:\windows\system\MEK.exe61⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGTBPH.exe.bat" "62⤵PID:2448
-
C:\windows\AGTBPH.exeC:\windows\AGTBPH.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCX.exe.bat" "64⤵PID:2628
-
C:\windows\SysWOW64\UCX.exeC:\windows\system32\UCX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMAAZNV.exe.bat" "66⤵PID:708
-
C:\windows\SysWOW64\TMAAZNV.exeC:\windows\system32\TMAAZNV.exe67⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHMWND.exe.bat" "68⤵PID:4728
-
C:\windows\UHMWND.exeC:\windows\UHMWND.exe69⤵
- Checks computer location settings
- Executes dropped EXE
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIM.exe.bat" "70⤵PID:3848
-
C:\windows\system\RIM.exeC:\windows\system\RIM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QAXAF.exe.bat" "72⤵PID:4620
-
C:\windows\system\QAXAF.exeC:\windows\system\QAXAF.exe73⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NYCXMVW.exe.bat" "74⤵PID:2328
-
C:\windows\system\NYCXMVW.exeC:\windows\system\NYCXMVW.exe75⤵
- Checks computer location settings
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBGS.exe.bat" "76⤵PID:1884
-
C:\windows\SysWOW64\NBGS.exeC:\windows\system32\NBGS.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ERFDD.exe.bat" "78⤵PID:4476
-
C:\windows\SysWOW64\ERFDD.exeC:\windows\system32\ERFDD.exe79⤵
- Checks computer location settings
- Executes dropped EXE
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJIWL.exe.bat" "80⤵PID:1428
-
C:\windows\PJIWL.exeC:\windows\PJIWL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PXALNZF.exe.bat" "82⤵PID:4948
-
C:\windows\PXALNZF.exeC:\windows\PXALNZF.exe83⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KKFU.exe.bat" "84⤵PID:4492
-
C:\windows\KKFU.exeC:\windows\KKFU.exe85⤵
- Executes dropped EXE
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDUFGRC.exe.bat" "86⤵PID:5036
-
C:\windows\system\DDUFGRC.exeC:\windows\system\DDUFGRC.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBAROAL.exe.bat" "88⤵PID:3864
-
C:\windows\SysWOW64\NBAROAL.exeC:\windows\system32\NBAROAL.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQHCAT.exe.bat" "90⤵PID:216
-
C:\windows\EQHCAT.exeC:\windows\EQHCAT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUYGEY.exe.bat" "92⤵PID:1424
-
C:\windows\system\WUYGEY.exeC:\windows\system\WUYGEY.exe93⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHJYUUP.exe.bat" "94⤵PID:2292
-
C:\windows\SysWOW64\FHJYUUP.exeC:\windows\system32\FHJYUUP.exe95⤵
- Executes dropped EXE
PID:448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEOV.exe.bat" "96⤵PID:4964
-
C:\windows\SysWOW64\CEOV.exeC:\windows\system32\CEOV.exe97⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXJNB.exe.bat" "98⤵PID:3648
-
C:\windows\NXJNB.exeC:\windows\NXJNB.exe99⤵
- Executes dropped EXE
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDPDQ.exe.bat" "100⤵PID:1664
-
C:\windows\system\KDPDQ.exeC:\windows\system\KDPDQ.exe101⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XIP.exe.bat" "102⤵PID:4980
-
C:\windows\XIP.exeC:\windows\XIP.exe103⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BQEWE.exe.bat" "104⤵PID:708
-
C:\windows\system\BQEWE.exeC:\windows\system\BQEWE.exe105⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTAVJIA.exe.bat" "106⤵PID:4156
-
C:\windows\OTAVJIA.exeC:\windows\OTAVJIA.exe107⤵
- Checks computer location settings
- Executes dropped EXE
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZGSQS.exe.bat" "108⤵PID:2172
-
C:\windows\SysWOW64\LZGSQS.exeC:\windows\system32\LZGSQS.exe109⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHIXU.exe.bat" "110⤵PID:4620
-
C:\windows\system\UHIXU.exeC:\windows\system\UHIXU.exe111⤵
- Executes dropped EXE
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JCRJNKF.exe.bat" "112⤵PID:2448
-
C:\windows\SysWOW64\JCRJNKF.exeC:\windows\system32\JCRJNKF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSSB.exe.bat" "114⤵PID:1852
-
C:\windows\SysWOW64\ZSSB.exeC:\windows\system32\ZSSB.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFXKWY.exe.bat" "116⤵PID:4632
-
C:\windows\system\TFXKWY.exeC:\windows\system\TFXKWY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAG.exe.bat" "118⤵PID:1980
-
C:\windows\SysWOW64\IAG.exeC:\windows\system32\IAG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWGXLV.exe.bat" "120⤵PID:4992
-
C:\windows\SysWOW64\PWGXLV.exeC:\windows\system32\PWGXLV.exe121⤵
- Executes dropped EXE
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJK.exe.bat" "122⤵PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-