Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 04:41
Behavioral task
behavioral1
Sample
cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe
Resource
win11-20240709-en
General
-
Target
cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe
-
Size
849KB
-
MD5
528d0fa7beea751d34448775846f21f1
-
SHA1
318aeca81bd46029ad098353e5517bed3ca74139
-
SHA256
cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da
-
SHA512
6bf9eea839e7fb0379d435060598710b15be8ebc541183274cbac4220c76ed49a59f985e20c8b5e5ab01b5819e0908256d8c55649790cda1ea4dd776e190a917
-
SSDEEP
24576:f+F0sIE9JqsC6mVFyCsffzMS6pcsP9Qtce0TBs/lPsoCyEbDb7Br5oANn90x5MO6:TbjnSU
Malware Config
Signatures
-
Detect Neshta payload 6 IoCs
resource yara_rule behavioral1/memory/4184-0-0x0000000000400000-0x000000000042B000-memory.dmp family_neshta behavioral1/files/0x0006000000020244-13.dat family_neshta behavioral1/memory/4184-98-0x0000000000400000-0x000000000042B000-memory.dmp family_neshta behavioral1/memory/4184-99-0x0000000000400000-0x000000000042B000-memory.dmp family_neshta behavioral1/memory/4184-100-0x0000000000400000-0x000000000042B000-memory.dmp family_neshta behavioral1/memory/4184-102-0x0000000000400000-0x000000000042B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hGtUNymlXilNdbLfeSvDg\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\hGtUNymlXilNdbLfeSvDg" cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Executes dropped EXE 1 IoCs
pid Process 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4184 wrote to memory of 832 4184 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 86 PID 4184 wrote to memory of 832 4184 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 86 PID 832 wrote to memory of 2728 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 89 PID 832 wrote to memory of 2728 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 89 PID 832 wrote to memory of 5088 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 95 PID 832 wrote to memory of 5088 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 95 PID 832 wrote to memory of 1484 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 97 PID 832 wrote to memory of 1484 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 97 PID 832 wrote to memory of 4304 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 98 PID 832 wrote to memory of 4304 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 98 PID 832 wrote to memory of 1896 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 99 PID 832 wrote to memory of 1896 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 99 PID 832 wrote to memory of 1140 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 101 PID 832 wrote to memory of 1140 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 101 PID 832 wrote to memory of 2012 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 102 PID 832 wrote to memory of 2012 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 102 PID 832 wrote to memory of 2912 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 103 PID 832 wrote to memory of 2912 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 103 PID 832 wrote to memory of 4712 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 104 PID 832 wrote to memory of 4712 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 104 PID 832 wrote to memory of 5096 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 105 PID 832 wrote to memory of 5096 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 105 PID 832 wrote to memory of 1416 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 106 PID 832 wrote to memory of 1416 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 106 PID 832 wrote to memory of 4152 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 108 PID 832 wrote to memory of 4152 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 108 PID 832 wrote to memory of 3212 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 109 PID 832 wrote to memory of 3212 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 109 PID 832 wrote to memory of 4488 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 110 PID 832 wrote to memory of 4488 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 110 PID 832 wrote to memory of 2464 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 111 PID 832 wrote to memory of 2464 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 111 PID 832 wrote to memory of 3248 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 112 PID 832 wrote to memory of 3248 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 112 PID 832 wrote to memory of 4108 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 113 PID 832 wrote to memory of 4108 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 113 PID 832 wrote to memory of 1792 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 116 PID 832 wrote to memory of 1792 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 116 PID 832 wrote to memory of 4384 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 117 PID 832 wrote to memory of 4384 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 117 PID 832 wrote to memory of 628 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 119 PID 832 wrote to memory of 628 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 119 PID 832 wrote to memory of 1564 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 120 PID 832 wrote to memory of 1564 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 120 PID 832 wrote to memory of 636 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 121 PID 832 wrote to memory of 636 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 121 PID 832 wrote to memory of 952 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 122 PID 832 wrote to memory of 952 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 122 PID 832 wrote to memory of 1492 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 123 PID 832 wrote to memory of 1492 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 123 PID 832 wrote to memory of 2952 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 124 PID 832 wrote to memory of 2952 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 124 PID 832 wrote to memory of 2016 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 125 PID 832 wrote to memory of 2016 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 125 PID 832 wrote to memory of 1864 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 126 PID 832 wrote to memory of 1864 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 126 PID 832 wrote to memory of 4824 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 127 PID 832 wrote to memory of 4824 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 127 PID 832 wrote to memory of 4124 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 128 PID 832 wrote to memory of 4124 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 128 PID 832 wrote to memory of 436 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 129 PID 832 wrote to memory of 436 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 129 PID 832 wrote to memory of 4164 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 130 PID 832 wrote to memory of 4164 832 cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe"C:\Users\Admin\AppData\Local\Temp\cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe"2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:5088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1896
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:5096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1492
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2952
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4824
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4548
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1788
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1176
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2908
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2352
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1108
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4184
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4572
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2580
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:5040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1940
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2512
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4756
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:312
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1328
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4704
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4664
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1668
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5a40427e3788637e741fb69ea8d76cd52
SHA1f8c8c7ec493e32a7573d90ce400fccd79fc98f31
SHA25618dcc8fae245869d02b7db0edbe22ec57a30bdd51a64090452118a79ba194052
SHA512e6b688d4ad0506c74db323b50a2588472f45e66da2a3456450aea96d93882b13662f8b3bbed7773180f5bec851a31d2e45262ecb9283b425c60c8caa06d56ca2
-
C:\Users\Admin\AppData\Local\Temp\3582-490\cea71a299ebe23ee56705c7b80d1b24751dc45fdbd8762618cfa5c99eccac3da.exe
Filesize808KB
MD54ac882ebdbc1431cdd3ab45e1712ada1
SHA1b871304fd060b700fd66ce0c87014ec955d12979
SHA256b13f23643fddce3f41b6908a00051b6688788668c81d698994c140bf6290c2d6
SHA512f3ff8d00849289436b723bc48c14113e51b583955d7f69870458d7b7d72ba214ad531d601a950b247f43325a610fd15cd6584008fd842a29c1dd0804ee2e6f98