Analysis
-
max time kernel
104s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e721cd0b41361048ffeaf94be64a090N.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
General
-
Target
2e721cd0b41361048ffeaf94be64a090N.exe
-
Size
4.9MB
-
MD5
2e721cd0b41361048ffeaf94be64a090
-
SHA1
0d5c61de07649f07f150785959ca3853f5d0529a
-
SHA256
d588c89ff1cee433b3b5d503e0adae787d8fbf8e516638cde0033de331aea1bb
-
SHA512
b9c264122c8e0eeb6007373d545a04900e0b9fc7866470b1fac7482f43972aab44352296e96076a898871e0962758bda3aba3e5aabee0d588b12a211d349f5d7
-
SSDEEP
49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
Family
colibri
Version
1.2.0
Botnet
Build1
C2
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2172 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4120 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4376 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 720 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3188 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1808 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3744 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3876 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 908 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4628 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1140 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3304 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 4932 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 4932 schtasks.exe 86 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe -
resource yara_rule behavioral2/memory/800-3-0x000000001BBC0000-0x000000001BCEE000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2568 powershell.exe 4436 powershell.exe 1768 powershell.exe 1788 powershell.exe 2604 powershell.exe 1224 powershell.exe 912 powershell.exe 1536 powershell.exe 3208 powershell.exe 3612 powershell.exe 4524 powershell.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation 2e721cd0b41361048ffeaf94be64a090N.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation SearchApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation Process not Found -
Executes dropped EXE 64 IoCs
pid Process 692 tmpD1BB.tmp.exe 4604 tmpD1BB.tmp.exe 3648 SearchApp.exe 3896 tmpFC80.tmp.exe 2632 tmpFC80.tmp.exe 720 tmpFC80.tmp.exe 2296 tmpFC80.tmp.exe 1916 SearchApp.exe 1508 SearchApp.exe 3852 tmp3851.tmp.exe 4260 tmp3851.tmp.exe 2900 SearchApp.exe 4504 tmp68F6.tmp.exe 3116 tmp68F6.tmp.exe 4816 tmp68F6.tmp.exe 3400 SearchApp.exe 636 tmp87D8.tmp.exe 1152 tmp87D8.tmp.exe 4776 tmp87D8.tmp.exe 1532 tmp87D8.tmp.exe 4936 tmp87D8.tmp.exe 4316 tmp87D8.tmp.exe 1552 tmp87D8.tmp.exe 2644 tmp87D8.tmp.exe 2568 tmp87D8.tmp.exe 4576 tmp87D8.tmp.exe 3128 tmp87D8.tmp.exe 3200 tmp87D8.tmp.exe 728 tmp87D8.tmp.exe 4104 tmp87D8.tmp.exe 4064 tmp87D8.tmp.exe 3584 tmp87D8.tmp.exe 1084 tmp87D8.tmp.exe 1196 tmp87D8.tmp.exe 4868 tmp87D8.tmp.exe 752 tmp87D8.tmp.exe 4968 tmp87D8.tmp.exe 5076 tmp87D8.tmp.exe 228 tmp87D8.tmp.exe 2960 tmp87D8.tmp.exe 3168 tmp87D8.tmp.exe 2156 tmp87D8.tmp.exe 1732 tmp87D8.tmp.exe 2696 tmp87D8.tmp.exe 3304 tmp87D8.tmp.exe 4940 tmp87D8.tmp.exe 2632 tmp87D8.tmp.exe 4888 tmp87D8.tmp.exe 3240 tmp87D8.tmp.exe 924 tmp87D8.tmp.exe 3044 tmp87D8.tmp.exe 4912 tmp87D8.tmp.exe 4872 tmp87D8.tmp.exe 2192 tmp87D8.tmp.exe 4844 tmp87D8.tmp.exe 940 tmp87D8.tmp.exe 1620 tmp87D8.tmp.exe 4200 tmp87D8.tmp.exe 4116 tmp87D8.tmp.exe 3512 tmp87D8.tmp.exe 2712 tmp87D8.tmp.exe 4052 tmp87D8.tmp.exe 1060 tmp87D8.tmp.exe 3416 tmp87D8.tmp.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SearchApp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 692 set thread context of 4604 692 tmpD1BB.tmp.exe 131 PID 720 set thread context of 2296 720 tmpFC80.tmp.exe 161 PID 3852 set thread context of 4260 3852 tmp3851.tmp.exe 170 PID 3116 set thread context of 4816 3116 tmp68F6.tmp.exe 179 PID 1572 set thread context of 4260 1572 tmpA4A7.tmp.exe 573 PID 1524 set thread context of 1732 1524 Process not Found 1170 PID 2612 set thread context of 320 2612 Process not Found 1835 PID 4044 set thread context of 3520 4044 Process not Found 2494 PID 4796 set thread context of 4912 4796 Process not Found 3301 -
Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\9e8d7a4ca61bd9 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dllhost.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Internet Explorer\fr-FR\886983d96e3d3e 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\dllhost.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5940a34987c991 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dwm.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\csrss.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Windows Defender\en-US\RCXDA2C.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Windows Portable Devices\RuntimeBroker.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCXE4EF.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Windows Defender\en-US\SearchApp.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Windows Defender\en-US\38384e6a620884 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Google\ea9f0e6c9e2dcd 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Common Files\Services\RCXDC40.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Internet Explorer\fr-FR\csrss.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Windows Portable Devices\9e8d7a4ca61bd9 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\RCXD596.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Microsoft\RuntimeBroker.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\6cb0b6c459d5d3 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\MSBuild\Microsoft\OfficeClickToRun.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Common Files\Services\6ccacd8608530f 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Microsoft\RuntimeBroker.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Google\taskhostw.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\RCXCF68.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\OfficeClickToRun.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Google\taskhostw.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\MSBuild\Microsoft\e6c9b481da804f 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files (x86)\Common Files\Services\Idle.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Windows Defender\en-US\SearchApp.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Common Files\Services\Idle.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Windows Portable Devices\RCXE2EA.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Google\RCXE994.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Program Files\Windows Portable Devices\RuntimeBroker.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\dwm.exe 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RCXD7AA.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Program Files (x86)\Microsoft\RCXE0D6.tmp 2e721cd0b41361048ffeaf94be64a090N.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\DigitalLocker\eddb19405b7ce1 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Windows\DigitalLocker\RCXE770.tmp 2e721cd0b41361048ffeaf94be64a090N.exe File opened for modification C:\Windows\DigitalLocker\backgroundTaskHost.exe 2e721cd0b41361048ffeaf94be64a090N.exe File created C:\Windows\DigitalLocker\backgroundTaskHost.exe 2e721cd0b41361048ffeaf94be64a090N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp87D8.tmp.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2e721cd0b41361048ffeaf94be64a090N.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings SearchApp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2008 schtasks.exe 1836 schtasks.exe 4804 schtasks.exe 3304 schtasks.exe 1724 schtasks.exe 4108 schtasks.exe 4988 schtasks.exe 3640 schtasks.exe 2764 schtasks.exe 4376 schtasks.exe 1584 schtasks.exe 2320 schtasks.exe 3876 schtasks.exe 1140 schtasks.exe 4112 schtasks.exe 720 schtasks.exe 3188 schtasks.exe 1524 schtasks.exe 4468 schtasks.exe 2644 schtasks.exe 2172 schtasks.exe 1516 schtasks.exe 2432 schtasks.exe 4476 schtasks.exe 1720 schtasks.exe 4120 schtasks.exe 2940 schtasks.exe 1304 schtasks.exe 1036 schtasks.exe 1388 schtasks.exe 908 schtasks.exe 4868 schtasks.exe 3744 schtasks.exe 3812 schtasks.exe 4628 schtasks.exe 2276 schtasks.exe 220 schtasks.exe 1808 schtasks.exe 1796 schtasks.exe 2756 schtasks.exe 4776 schtasks.exe 2580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 800 2e721cd0b41361048ffeaf94be64a090N.exe 1788 powershell.exe 1788 powershell.exe 4524 powershell.exe 4524 powershell.exe 2568 powershell.exe 2568 powershell.exe 2604 powershell.exe 2604 powershell.exe 3612 powershell.exe 3612 powershell.exe 1768 powershell.exe 1768 powershell.exe 912 powershell.exe 912 powershell.exe 3208 powershell.exe 3208 powershell.exe 2604 powershell.exe 1536 powershell.exe 1536 powershell.exe 4436 powershell.exe 4436 powershell.exe 1224 powershell.exe 1224 powershell.exe 4436 powershell.exe 4524 powershell.exe 3612 powershell.exe 1788 powershell.exe 2568 powershell.exe 1768 powershell.exe 912 powershell.exe 1536 powershell.exe 3208 powershell.exe 1224 powershell.exe 3648 SearchApp.exe 3648 SearchApp.exe 1916 SearchApp.exe 1508 SearchApp.exe 2900 SearchApp.exe 3400 SearchApp.exe 4768 SearchApp.exe 3296 SearchApp.exe 3200 Process not Found 4724 Process not Found 376 Process not Found -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 800 2e721cd0b41361048ffeaf94be64a090N.exe Token: SeDebugPrivilege 1788 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeDebugPrivilege 3612 powershell.exe Token: SeDebugPrivilege 1768 powershell.exe Token: SeDebugPrivilege 912 powershell.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeDebugPrivilege 3208 powershell.exe Token: SeDebugPrivilege 1536 powershell.exe Token: SeDebugPrivilege 1224 powershell.exe Token: SeDebugPrivilege 3648 SearchApp.exe Token: SeDebugPrivilege 1916 SearchApp.exe Token: SeDebugPrivilege 1508 SearchApp.exe Token: SeDebugPrivilege 2900 SearchApp.exe Token: SeDebugPrivilege 3400 SearchApp.exe Token: SeDebugPrivilege 4768 SearchApp.exe Token: SeDebugPrivilege 3296 SearchApp.exe Token: SeDebugPrivilege 3200 Process not Found Token: SeDebugPrivilege 4724 Process not Found Token: SeDebugPrivilege 376 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 800 wrote to memory of 692 800 2e721cd0b41361048ffeaf94be64a090N.exe 129 PID 800 wrote to memory of 692 800 2e721cd0b41361048ffeaf94be64a090N.exe 129 PID 800 wrote to memory of 692 800 2e721cd0b41361048ffeaf94be64a090N.exe 129 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 692 wrote to memory of 4604 692 tmpD1BB.tmp.exe 131 PID 800 wrote to memory of 1224 800 2e721cd0b41361048ffeaf94be64a090N.exe 132 PID 800 wrote to memory of 1224 800 2e721cd0b41361048ffeaf94be64a090N.exe 132 PID 800 wrote to memory of 4524 800 2e721cd0b41361048ffeaf94be64a090N.exe 133 PID 800 wrote to memory of 4524 800 2e721cd0b41361048ffeaf94be64a090N.exe 133 PID 800 wrote to memory of 2568 800 2e721cd0b41361048ffeaf94be64a090N.exe 134 PID 800 wrote to memory of 2568 800 2e721cd0b41361048ffeaf94be64a090N.exe 134 PID 800 wrote to memory of 2604 800 2e721cd0b41361048ffeaf94be64a090N.exe 135 PID 800 wrote to memory of 2604 800 2e721cd0b41361048ffeaf94be64a090N.exe 135 PID 800 wrote to memory of 1788 800 2e721cd0b41361048ffeaf94be64a090N.exe 136 PID 800 wrote to memory of 1788 800 2e721cd0b41361048ffeaf94be64a090N.exe 136 PID 800 wrote to memory of 1768 800 2e721cd0b41361048ffeaf94be64a090N.exe 138 PID 800 wrote to memory of 1768 800 2e721cd0b41361048ffeaf94be64a090N.exe 138 PID 800 wrote to memory of 3612 800 2e721cd0b41361048ffeaf94be64a090N.exe 139 PID 800 wrote to memory of 3612 800 2e721cd0b41361048ffeaf94be64a090N.exe 139 PID 800 wrote to memory of 3208 800 2e721cd0b41361048ffeaf94be64a090N.exe 140 PID 800 wrote to memory of 3208 800 2e721cd0b41361048ffeaf94be64a090N.exe 140 PID 800 wrote to memory of 4436 800 2e721cd0b41361048ffeaf94be64a090N.exe 141 PID 800 wrote to memory of 4436 800 2e721cd0b41361048ffeaf94be64a090N.exe 141 PID 800 wrote to memory of 1536 800 2e721cd0b41361048ffeaf94be64a090N.exe 142 PID 800 wrote to memory of 1536 800 2e721cd0b41361048ffeaf94be64a090N.exe 142 PID 800 wrote to memory of 912 800 2e721cd0b41361048ffeaf94be64a090N.exe 144 PID 800 wrote to memory of 912 800 2e721cd0b41361048ffeaf94be64a090N.exe 144 PID 800 wrote to memory of 3648 800 2e721cd0b41361048ffeaf94be64a090N.exe 154 PID 800 wrote to memory of 3648 800 2e721cd0b41361048ffeaf94be64a090N.exe 154 PID 3648 wrote to memory of 2584 3648 SearchApp.exe 155 PID 3648 wrote to memory of 2584 3648 SearchApp.exe 155 PID 3648 wrote to memory of 2144 3648 SearchApp.exe 156 PID 3648 wrote to memory of 2144 3648 SearchApp.exe 156 PID 3648 wrote to memory of 3896 3648 SearchApp.exe 157 PID 3648 wrote to memory of 3896 3648 SearchApp.exe 157 PID 3648 wrote to memory of 3896 3648 SearchApp.exe 157 PID 3896 wrote to memory of 2632 3896 tmpFC80.tmp.exe 159 PID 3896 wrote to memory of 2632 3896 tmpFC80.tmp.exe 159 PID 3896 wrote to memory of 2632 3896 tmpFC80.tmp.exe 159 PID 2632 wrote to memory of 720 2632 tmpFC80.tmp.exe 160 PID 2632 wrote to memory of 720 2632 tmpFC80.tmp.exe 160 PID 2632 wrote to memory of 720 2632 tmpFC80.tmp.exe 160 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 720 wrote to memory of 2296 720 tmpFC80.tmp.exe 161 PID 2584 wrote to memory of 1916 2584 WScript.exe 162 PID 2584 wrote to memory of 1916 2584 WScript.exe 162 PID 1916 wrote to memory of 4784 1916 SearchApp.exe 163 PID 1916 wrote to memory of 4784 1916 SearchApp.exe 163 PID 1916 wrote to memory of 3644 1916 SearchApp.exe 164 PID 1916 wrote to memory of 3644 1916 SearchApp.exe 164 PID 4784 wrote to memory of 1508 4784 WScript.exe 165 PID 4784 wrote to memory of 1508 4784 WScript.exe 165 PID 1508 wrote to memory of 3224 1508 SearchApp.exe 166 PID 1508 wrote to memory of 3224 1508 SearchApp.exe 166 -
System policy modification 1 TTPs 33 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e721cd0b41361048ffeaf94be64a090N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SearchApp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e721cd0b41361048ffeaf94be64a090N.exe"C:\Users\Admin\AppData\Local\Temp\2e721cd0b41361048ffeaf94be64a090N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:800 -
C:\Users\Admin\AppData\Local\Temp\tmpD1BB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD1BB.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\tmpD1BB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD1BB.tmp.exe"3⤵
- Executes dropped EXE
PID:4604
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3648 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bac17533-be62-40be-8585-1d22983474d2.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1916 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c29de8fb-c471-44ea-9ac1-c7ad4bfa0040.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1508 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b8e3667-64a9-434f-a2dd-5e925f1b250b.vbs"7⤵PID:3224
-
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2900 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b536c9a2-a0bb-42ca-9f25-20d25acb14e9.vbs"9⤵PID:4112
-
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3400 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a1ade61-c829-44f6-9851-b36b804452c3.vbs"11⤵PID:4524
-
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"12⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4768 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b325c2fe-0158-400a-b9a2-916ba2f07520.vbs"13⤵PID:5048
-
C:\Program Files\Windows Defender\en-US\SearchApp.exe"C:\Program Files\Windows Defender\en-US\SearchApp.exe"14⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3296 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f768b7d-e2cc-417a-950a-ce88c5710b35.vbs"15⤵PID:2276
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91edfb4f-2fc6-46bb-8e30-b42773d398dc.vbs"15⤵PID:232
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0219f9a4-81b9-427d-9c37-7d99aca2028c.vbs"13⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA4A7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA4A7.tmp.exe"13⤵
- Suspicious use of SetThreadContext
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\tmpA4A7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA4A7.tmp.exe"14⤵PID:4260
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b9896d5-bdce-4849-9e3f-8fb4aec8ed3d.vbs"11⤵PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"11⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"12⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"14⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"15⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"16⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"17⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"18⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"19⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"20⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"21⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"22⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"23⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"24⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"25⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"26⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"27⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"28⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"29⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"30⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"31⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"32⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"33⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"34⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"35⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"36⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"37⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"38⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"39⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"40⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"41⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"42⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"43⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"44⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"45⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"46⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"47⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"48⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"49⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"50⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"51⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"52⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"53⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"54⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"55⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"56⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"57⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"58⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"59⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"60⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"61⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"62⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"63⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"64⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"65⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"66⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"67⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"68⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"69⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"70⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"71⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"72⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"73⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"74⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"75⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"76⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"77⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"78⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"79⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"80⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"81⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"82⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"83⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"84⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"85⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"86⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"87⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"88⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"89⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"90⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"91⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"92⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"93⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"94⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"95⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"97⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"98⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"99⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"100⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"101⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"102⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"103⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"104⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"105⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"106⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"107⤵
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"109⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"110⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"111⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"112⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"113⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"114⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"115⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"116⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"117⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"118⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"119⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"120⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87D8.tmp.exe"121⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-