Analysis
-
max time kernel
61s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 03:01
Behavioral task
behavioral1
Sample
G_Client.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
G_Client.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
G_Server.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
G_Server.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
G_Server.exe
-
Size
260KB
-
MD5
0edb1943992f9bfad9d79642f27d80a4
-
SHA1
fddb79d316c00da342c075cc76aa1cdf7ad999b1
-
SHA256
feb98fc67888867c3805697f9fbcc33120cc197afcebbcf77aa068628242695e
-
SHA512
04a3b1f8c5de82cf765a9f6e1329b8dd62d4a69740036f2d9c724b0e8f5017d8eef5c512866fc69eb0318f452a9be51bcfc3a228ba336e81188cd3289ff988c6
-
SSDEEP
6144:t9M6k7TTnKAbDrAzdZQre61669JvRtWu47Be:t9Zk73KAbQTQJk6DptWR
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2736 Kernel32.exe 2920 Kernel32.exe 2196 Kernel32.exe 2976 Kernel32.exe 860 Kernel32.exe 1652 Kernel32.exe 2240 Kernel32.exe 2012 Kernel32.exe 2424 Kernel32.exe 2524 Kernel32.exe 292 Kernel32.exe 1704 Kernel32.exe 744 Kernel32.exe 2008 Kernel32.exe 3056 Kernel32.exe 680 Kernel32.exe 1680 Kernel32.exe 2752 Kernel32.exe 2836 Kernel32.exe 2928 Kernel32.exe 2784 Kernel32.exe 2668 Kernel32.exe 2272 Kernel32.exe 2144 Kernel32.exe 2196 Kernel32.exe 1712 Kernel32.exe 788 Kernel32.exe 1332 Kernel32.exe 3020 Kernel32.exe 1136 Kernel32.exe 768 Kernel32.exe 1792 Kernel32.exe 1128 Kernel32.exe 992 Kernel32.exe 1144 Kernel32.exe 852 Kernel32.exe 2956 Kernel32.exe 2912 Kernel32.exe 2476 Kernel32.exe 1300 Kernel32.exe 2024 Kernel32.exe 1972 Kernel32.exe 1560 Kernel32.exe 2984 Kernel32.exe 1820 Kernel32.exe 1572 Kernel32.exe 1956 Kernel32.exe 1864 Kernel32.exe 904 Kernel32.exe 408 Kernel32.exe 2404 Kernel32.exe 2140 Kernel32.exe 2400 Kernel32.exe 1940 Kernel32.exe 864 Kernel32.exe 108 Kernel32.exe 1584 Kernel32.exe 2756 Kernel32.exe 2780 Kernel32.exe 2212 Kernel32.exe 2572 Kernel32.exe 2584 Kernel32.exe 872 Kernel32.exe 2828 Kernel32.exe -
Loads dropped DLL 64 IoCs
pid Process 1280 G_Server.exe 1280 G_Server.exe 2736 Kernel32.exe 2736 Kernel32.exe 2736 Kernel32.exe 2920 Kernel32.exe 2920 Kernel32.exe 2920 Kernel32.exe 2196 Kernel32.exe 2196 Kernel32.exe 2196 Kernel32.exe 2976 Kernel32.exe 2976 Kernel32.exe 2976 Kernel32.exe 860 Kernel32.exe 860 Kernel32.exe 860 Kernel32.exe 1652 Kernel32.exe 1652 Kernel32.exe 1652 Kernel32.exe 2240 Kernel32.exe 2240 Kernel32.exe 2240 Kernel32.exe 2012 Kernel32.exe 2012 Kernel32.exe 2012 Kernel32.exe 2424 Kernel32.exe 2424 Kernel32.exe 2424 Kernel32.exe 2524 Kernel32.exe 2524 Kernel32.exe 2524 Kernel32.exe 292 Kernel32.exe 292 Kernel32.exe 292 Kernel32.exe 1704 Kernel32.exe 1704 Kernel32.exe 1704 Kernel32.exe 744 Kernel32.exe 744 Kernel32.exe 744 Kernel32.exe 2008 Kernel32.exe 2008 Kernel32.exe 2008 Kernel32.exe 3056 Kernel32.exe 3056 Kernel32.exe 3056 Kernel32.exe 680 Kernel32.exe 680 Kernel32.exe 680 Kernel32.exe 1680 Kernel32.exe 1680 Kernel32.exe 1680 Kernel32.exe 2752 Kernel32.exe 2752 Kernel32.exe 2752 Kernel32.exe 2836 Kernel32.exe 2836 Kernel32.exe 2836 Kernel32.exe 2928 Kernel32.exe 2928 Kernel32.exe 2928 Kernel32.exe 2784 Kernel32.exe 2784 Kernel32.exe -
Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\system32\\Kernel32.exe" Kernel32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe G_Server.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe File opened for modification C:\Windows\SysWOW64\Sysexplr.exe Kernel32.exe File created C:\Windows\SysWOW64\Kernel32.exe Kernel32.exe -
resource yara_rule behavioral3/memory/1280-0-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/files/0x000700000001756a-7.dat upx behavioral3/memory/1280-26-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2736-36-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1280-23-0x00000000035A0000-0x0000000003659000-memory.dmp upx behavioral3/memory/2736-41-0x00000000003F0000-0x0000000000400000-memory.dmp upx behavioral3/memory/2736-47-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2920-48-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2920-67-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2196-84-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2008-250-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/680-272-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2752-294-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1136-425-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2584-760-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/872-776-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2212-740-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2572-756-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2756-720-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2780-736-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/108-700-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1584-716-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1940-680-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/864-696-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2140-660-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2400-676-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/408-640-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2404-656-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1864-620-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/904-636-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1572-600-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1956-616-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2984-580-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1820-596-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1972-558-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1560-575-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1300-536-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2024-553-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2912-514-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2476-531-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/852-492-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2956-509-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/992-470-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1144-487-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1128-465-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1792-447-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/768-436-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/3020-414-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1332-403-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/788-392-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1712-381-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2196-376-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2144-360-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2668-338-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2272-355-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2928-316-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2784-333-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2836-311-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1680-289-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/3056-267-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/1704-227-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/744-245-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/2524-195-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral3/memory/292-219-0x0000000000400000-0x00000000004B9000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kernel32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\Sysexplr.exe %1" Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\Shell\open\command Kernel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" Kernel32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2736 1280 G_Server.exe 31 PID 1280 wrote to memory of 2736 1280 G_Server.exe 31 PID 1280 wrote to memory of 2736 1280 G_Server.exe 31 PID 1280 wrote to memory of 2736 1280 G_Server.exe 31 PID 2736 wrote to memory of 2920 2736 Kernel32.exe 32 PID 2736 wrote to memory of 2920 2736 Kernel32.exe 32 PID 2736 wrote to memory of 2920 2736 Kernel32.exe 32 PID 2736 wrote to memory of 2920 2736 Kernel32.exe 32 PID 2920 wrote to memory of 2196 2920 Kernel32.exe 55 PID 2920 wrote to memory of 2196 2920 Kernel32.exe 55 PID 2920 wrote to memory of 2196 2920 Kernel32.exe 55 PID 2920 wrote to memory of 2196 2920 Kernel32.exe 55 PID 2196 wrote to memory of 2976 2196 Kernel32.exe 34 PID 2196 wrote to memory of 2976 2196 Kernel32.exe 34 PID 2196 wrote to memory of 2976 2196 Kernel32.exe 34 PID 2196 wrote to memory of 2976 2196 Kernel32.exe 34 PID 2976 wrote to memory of 860 2976 Kernel32.exe 35 PID 2976 wrote to memory of 860 2976 Kernel32.exe 35 PID 2976 wrote to memory of 860 2976 Kernel32.exe 35 PID 2976 wrote to memory of 860 2976 Kernel32.exe 35 PID 860 wrote to memory of 1652 860 Kernel32.exe 36 PID 860 wrote to memory of 1652 860 Kernel32.exe 36 PID 860 wrote to memory of 1652 860 Kernel32.exe 36 PID 860 wrote to memory of 1652 860 Kernel32.exe 36 PID 1652 wrote to memory of 2240 1652 Kernel32.exe 37 PID 1652 wrote to memory of 2240 1652 Kernel32.exe 37 PID 1652 wrote to memory of 2240 1652 Kernel32.exe 37 PID 1652 wrote to memory of 2240 1652 Kernel32.exe 37 PID 2240 wrote to memory of 2012 2240 Kernel32.exe 38 PID 2240 wrote to memory of 2012 2240 Kernel32.exe 38 PID 2240 wrote to memory of 2012 2240 Kernel32.exe 38 PID 2240 wrote to memory of 2012 2240 Kernel32.exe 38 PID 2012 wrote to memory of 2424 2012 Kernel32.exe 39 PID 2012 wrote to memory of 2424 2012 Kernel32.exe 39 PID 2012 wrote to memory of 2424 2012 Kernel32.exe 39 PID 2012 wrote to memory of 2424 2012 Kernel32.exe 39 PID 2424 wrote to memory of 2524 2424 Kernel32.exe 40 PID 2424 wrote to memory of 2524 2424 Kernel32.exe 40 PID 2424 wrote to memory of 2524 2424 Kernel32.exe 40 PID 2424 wrote to memory of 2524 2424 Kernel32.exe 40 PID 2524 wrote to memory of 292 2524 Kernel32.exe 41 PID 2524 wrote to memory of 292 2524 Kernel32.exe 41 PID 2524 wrote to memory of 292 2524 Kernel32.exe 41 PID 2524 wrote to memory of 292 2524 Kernel32.exe 41 PID 292 wrote to memory of 1704 292 Kernel32.exe 42 PID 292 wrote to memory of 1704 292 Kernel32.exe 42 PID 292 wrote to memory of 1704 292 Kernel32.exe 42 PID 292 wrote to memory of 1704 292 Kernel32.exe 42 PID 1704 wrote to memory of 744 1704 Kernel32.exe 43 PID 1704 wrote to memory of 744 1704 Kernel32.exe 43 PID 1704 wrote to memory of 744 1704 Kernel32.exe 43 PID 1704 wrote to memory of 744 1704 Kernel32.exe 43 PID 744 wrote to memory of 2008 744 Kernel32.exe 44 PID 744 wrote to memory of 2008 744 Kernel32.exe 44 PID 744 wrote to memory of 2008 744 Kernel32.exe 44 PID 744 wrote to memory of 2008 744 Kernel32.exe 44 PID 2008 wrote to memory of 3056 2008 Kernel32.exe 45 PID 2008 wrote to memory of 3056 2008 Kernel32.exe 45 PID 2008 wrote to memory of 3056 2008 Kernel32.exe 45 PID 2008 wrote to memory of 3056 2008 Kernel32.exe 45 PID 3056 wrote to memory of 680 3056 Kernel32.exe 46 PID 3056 wrote to memory of 680 3056 Kernel32.exe 46 PID 3056 wrote to memory of 680 3056 Kernel32.exe 46 PID 3056 wrote to memory of 680 3056 Kernel32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\G_Server.exe"C:\Users\Admin\AppData\Local\Temp\G_Server.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:680 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2752 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"23⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"24⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"25⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"26⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"27⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"28⤵
- Executes dropped EXE
PID:788 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:1332 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"30⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"31⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"32⤵
- Executes dropped EXE
- Modifies registry class
PID:768 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"34⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"35⤵
- Executes dropped EXE
PID:992 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"36⤵
- Executes dropped EXE
PID:1144 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"37⤵
- Executes dropped EXE
PID:852 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"38⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"39⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2912 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"40⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"41⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"42⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"43⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1560 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"45⤵
- Executes dropped EXE
- Modifies registry class
PID:2984 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"46⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"47⤵
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"48⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"49⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"50⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"51⤵
- Executes dropped EXE
PID:408 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"52⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"53⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"54⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"55⤵
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"56⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
PID:864 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"57⤵
- Executes dropped EXE
PID:108 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1584 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"59⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2756 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"60⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"61⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2572 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"63⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:872 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"65⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"66⤵
- Adds Run key to start application
PID:2412 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"67⤵PID:2896
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"68⤵
- Modifies registry class
PID:2908 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"69⤵PID:1748
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"70⤵PID:1588
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"71⤵PID:3068
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"72⤵PID:3028
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"73⤵PID:668
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"74⤵PID:484
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"75⤵PID:2808
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"76⤵PID:2864
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"77⤵PID:2084
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"78⤵
- Modifies system executable filetype association
PID:2968 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"79⤵PID:2248
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"80⤵
- Modifies system executable filetype association
PID:2800 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"81⤵
- Modifies registry class
PID:2652 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"82⤵PID:2484
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"83⤵PID:1608
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"84⤵
- Modifies registry class
PID:2520 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"85⤵PID:2888
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"86⤵
- Modifies system executable filetype association
PID:1576 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"87⤵PID:1780
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"88⤵
- Modifies registry class
PID:1916 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"89⤵PID:2744
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"90⤵PID:2228
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"91⤵PID:2984
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"92⤵PID:852
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"93⤵
- Modifies registry class
PID:2740 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"94⤵PID:896
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"95⤵
- Modifies system executable filetype association
PID:2788 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"96⤵
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"97⤵
- Modifies system executable filetype association
PID:2184 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"98⤵PID:356
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"99⤵
- Drops file in System32 directory
PID:2388 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"100⤵
- Adds Run key to start application
PID:2736 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"101⤵PID:1728
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"102⤵PID:1364
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"103⤵PID:2316
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"104⤵PID:2240
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"105⤵PID:2636
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"106⤵PID:1144
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"107⤵PID:1744
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"108⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"109⤵PID:1092
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"110⤵
- Adds Run key to start application
PID:2564 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"111⤵PID:1264
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"112⤵PID:1360
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"113⤵PID:1688
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"114⤵PID:2692
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"115⤵PID:1972
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"116⤵PID:2140
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"117⤵PID:2708
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"118⤵PID:1232
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"119⤵
- Adds Run key to start application
PID:1036 -
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"120⤵PID:1684
-
C:\Windows\SysWOW64\Kernel32.exe"C:\Windows\system32\Kernel32.exe"121⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-