Analysis
-
max time kernel
130s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
-
Target
8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe
-
Size
4.9MB
-
MD5
87c0d521f3387245929438143a477b30
-
SHA1
d427908e35f8a94c83750d923b32c91583091981
-
SHA256
8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93
-
SHA512
f0f2d6916ad0082e4e30874e1df32bb9250e4f4d7557746eda09c8d38ac115122856cb19361f4d6085326b7826a029ad6e413dabfb81ef439913c711e0c2ac29
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
Family
colibri
Version
1.2.0
Botnet
Build1
C2
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 57 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3244 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1336 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 712 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4288 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3448 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1016 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4908 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2588 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4232 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 760 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4812 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3020 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3292 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2976 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3404 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1676 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3776 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2144 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 916 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1028 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3232 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4844 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1336 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4508 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 712 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3780 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4796 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 2740 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3340 2740 schtasks.exe 84 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found -
resource yara_rule behavioral2/memory/2652-2-0x000000001C1D0000-0x000000001C2FE000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1728 powershell.exe 4732 powershell.exe 4572 powershell.exe 4940 powershell.exe 4748 powershell.exe 224 powershell.exe 2588 powershell.exe 4564 powershell.exe 3488 powershell.exe 3140 powershell.exe 4948 powershell.exe -
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Process not Found -
Executes dropped EXE 64 IoCs
pid Process 2916 tmpBD83.tmp.exe 4872 tmpBD83.tmp.exe 1384 tmpBD83.tmp.exe 4708 tmpBD83.tmp.exe 4004 tmpBD83.tmp.exe 3868 tmpBD83.tmp.exe 2360 tmpBD83.tmp.exe 3204 tmpBD83.tmp.exe 2104 tmpBD83.tmp.exe 4408 tmpBD83.tmp.exe 4716 tmpBD83.tmp.exe 876 tmpBD83.tmp.exe 3824 tmpBD83.tmp.exe 5112 tmpBD83.tmp.exe 4184 tmpBD83.tmp.exe 2948 tmpBD83.tmp.exe 3196 tmpBD83.tmp.exe 3352 tmpBD83.tmp.exe 4840 tmpBD83.tmp.exe 936 tmpBD83.tmp.exe 680 tmpBD83.tmp.exe 2072 tmpBD83.tmp.exe 1880 tmpBD83.tmp.exe 3060 tmpBD83.tmp.exe 2340 tmpBD83.tmp.exe 3480 tmpBD83.tmp.exe 2780 tmpBD83.tmp.exe 2856 tmpBD83.tmp.exe 2164 tmpBD83.tmp.exe 3392 tmpBD83.tmp.exe 2496 tmpBD83.tmp.exe 4660 tmpBD83.tmp.exe 4644 tmpBD83.tmp.exe 5012 tmpBD83.tmp.exe 4988 tmpBD83.tmp.exe 2260 tmpBD83.tmp.exe 4748 tmpBD83.tmp.exe 452 tmpBD83.tmp.exe 3100 tmpBD83.tmp.exe 2060 tmpBD83.tmp.exe 392 tmpBD83.tmp.exe 4872 tmpBD83.tmp.exe 740 tmpBD83.tmp.exe 1148 tmpBD83.tmp.exe 2864 tmpBD83.tmp.exe 3716 tmpBD83.tmp.exe 3652 tmpBD83.tmp.exe 1532 tmpBD83.tmp.exe 3104 tmpBD83.tmp.exe 2928 tmpBD83.tmp.exe 2104 tmpBD83.tmp.exe 3964 tmpBD83.tmp.exe 4128 tmpBD83.tmp.exe 1272 tmpBD83.tmp.exe 1780 tmpBD83.tmp.exe 876 tmpBD83.tmp.exe 4560 tmpBD83.tmp.exe 2516 tmpBD83.tmp.exe 2152 tmpBD83.tmp.exe 4348 tmpBD83.tmp.exe 2620 tmpBD83.tmp.exe 5004 tmpBD83.tmp.exe 2948 tmpBD83.tmp.exe 2148 tmpBD83.tmp.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sysmon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sysmon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 4552 set thread context of 4744 4552 tmpFB19.tmp.exe 1171 PID 3688 set thread context of 3336 3688 Process not Found 2280 PID 3332 set thread context of 2380 3332 Process not Found 2715 PID 4932 set thread context of 3360 4932 Process not Found 3197 PID 4588 set thread context of 1812 4588 Process not Found 4241 PID 2040 set thread context of 4340 2040 Process not Found 4463 PID 3332 set thread context of 2636 3332 Process not Found 5076 PID 4712 set thread context of 1960 4712 Process not Found 5513 PID 4244 set thread context of 3972 4244 Process not Found 5425 PID 2640 set thread context of 2184 2640 Process not Found 6215 PID 4796 set thread context of 1360 4796 Process not Found 6567 PID 3192 set thread context of 4268 3192 Process not Found 6982 -
Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\System.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\7-Zip\Lang\System.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Windows Mail\RCXD20E.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Windows Mail\smss.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Windows Portable Devices\RCXE232.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Windows Portable Devices\lsass.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\7-Zip\Lang\27d1bcfc3c54e0 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Windows Mail\smss.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Windows Mail\69ddcba757bf72 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Windows Portable Devices\6203df4a6bafc7 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Uninstall Information\SppExtComObj.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Uninstall Information\SppExtComObj.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Uninstall Information\e1ef82546f0b02 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\Windows Portable Devices\lsass.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\wininit.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files\ModifiableWindowsApps\unsecapp.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\56085415360792 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\7-Zip\Lang\RCXC5B4.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files\Uninstall Information\RCXD618.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCXE437.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe -
Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\SchCache\Registry.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Sun\sppsvc.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\SchCache\Registry.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\uk-UA\SppExtComObj.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Speech\Engines\wininit.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\uk-UA\RCXC3A0.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Sun\Java\Deployment\RCXE63C.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Sun\RCXE840.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\uk-UA\SppExtComObj.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\uk-UA\e1ef82546f0b02 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Sun\Java\Deployment\winlogon.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Sun\Java\Deployment\cc11b995f2a76d 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\PrintDialog\Assets\RCXD81C.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\PrintDialog\Assets\System.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\SchCache\RCXDC25.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Sun\Java\Deployment\winlogon.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\PrintDialog\Assets\System.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\SchCache\ee2ad38f3d4382 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Sun\sppsvc.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Speech\Engines\56085415360792 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\PrintDialog\Assets\27d1bcfc3c54e0 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\Sun\0a1fd5f707cd16 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Speech\Engines\RCXCDE6.tmp 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File opened for modification C:\Windows\Speech\Engines\wininit.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..licationframe-frame_31bf3856ad364e35_10.0.19041.1_none_73046ed56177b039\RuntimeBroker.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe File created C:\Windows\servicing\sysmon.exe 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpBD83.tmp.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings Process not Found -
Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3244 schtasks.exe 1208 schtasks.exe 4844 schtasks.exe 4812 schtasks.exe 3404 schtasks.exe 2144 schtasks.exe 1812 schtasks.exe 628 schtasks.exe 2272 schtasks.exe 712 schtasks.exe 2588 schtasks.exe 1336 schtasks.exe 2076 schtasks.exe 1016 schtasks.exe 2356 schtasks.exe 4232 schtasks.exe 3020 schtasks.exe 1028 schtasks.exe 5052 schtasks.exe 1588 schtasks.exe 4288 schtasks.exe 4108 schtasks.exe 1984 schtasks.exe 916 schtasks.exe 712 schtasks.exe 1360 schtasks.exe 1584 schtasks.exe 3488 schtasks.exe 3904 schtasks.exe 1676 schtasks.exe 1812 schtasks.exe 2676 schtasks.exe 2260 schtasks.exe 3012 schtasks.exe 2976 schtasks.exe 3776 schtasks.exe 4508 schtasks.exe 4796 schtasks.exe 4660 schtasks.exe 4412 schtasks.exe 760 schtasks.exe 3448 schtasks.exe 3340 schtasks.exe 2296 schtasks.exe 3232 schtasks.exe 3780 schtasks.exe 1336 schtasks.exe 4868 schtasks.exe 3700 schtasks.exe 4908 schtasks.exe 2352 schtasks.exe 1856 schtasks.exe 1876 schtasks.exe 2868 schtasks.exe 4556 schtasks.exe 1148 schtasks.exe 3292 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 3140 powershell.exe 3140 powershell.exe 4564 powershell.exe 4564 powershell.exe 4940 powershell.exe 4940 powershell.exe 3488 powershell.exe 3488 powershell.exe 4948 powershell.exe 4948 powershell.exe 4572 powershell.exe 4572 powershell.exe 2588 powershell.exe 2588 powershell.exe 4732 powershell.exe 4732 powershell.exe 224 powershell.exe 224 powershell.exe 4564 powershell.exe 1728 powershell.exe 1728 powershell.exe 4748 powershell.exe 4748 powershell.exe 1728 powershell.exe 4940 powershell.exe 3140 powershell.exe 3140 powershell.exe 4732 powershell.exe 224 powershell.exe 2588 powershell.exe 4572 powershell.exe 3488 powershell.exe 4948 powershell.exe 4748 powershell.exe 4760 sysmon.exe 4760 sysmon.exe 4240 Process not Found 3980 Process not Found 1300 Process not Found 2584 Process not Found 392 Process not Found 4420 Process not Found 1808 Process not Found 2248 Process not Found 2248 Process not Found 4856 Process not Found 1960 Process not Found -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 4940 powershell.exe Token: SeDebugPrivilege 3488 powershell.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 224 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4760 sysmon.exe Token: SeDebugPrivilege 4240 Process not Found Token: SeDebugPrivilege 3980 Process not Found Token: SeDebugPrivilege 1300 Process not Found Token: SeDebugPrivilege 2584 Process not Found Token: SeDebugPrivilege 392 Process not Found Token: SeDebugPrivilege 4420 Process not Found Token: SeDebugPrivilege 1808 Process not Found Token: SeDebugPrivilege 2248 Process not Found Token: SeDebugPrivilege 4856 Process not Found Token: SeDebugPrivilege 1960 Process not Found Token: SeDebugPrivilege 2368 Process not Found Token: SeDebugPrivilege 3532 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2916 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 104 PID 2652 wrote to memory of 2916 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 104 PID 2652 wrote to memory of 2916 2652 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe 104 PID 2916 wrote to memory of 4872 2916 tmpBD83.tmp.exe 184 PID 2916 wrote to memory of 4872 2916 tmpBD83.tmp.exe 184 PID 2916 wrote to memory of 4872 2916 tmpBD83.tmp.exe 184 PID 4872 wrote to memory of 1384 4872 tmpBD83.tmp.exe 115 PID 4872 wrote to memory of 1384 4872 tmpBD83.tmp.exe 115 PID 4872 wrote to memory of 1384 4872 tmpBD83.tmp.exe 115 PID 1384 wrote to memory of 4708 1384 tmpBD83.tmp.exe 116 PID 1384 wrote to memory of 4708 1384 tmpBD83.tmp.exe 116 PID 1384 wrote to memory of 4708 1384 tmpBD83.tmp.exe 116 PID 4708 wrote to memory of 4004 4708 tmpBD83.tmp.exe 117 PID 4708 wrote to memory of 4004 4708 tmpBD83.tmp.exe 117 PID 4708 wrote to memory of 4004 4708 tmpBD83.tmp.exe 117 PID 4004 wrote to memory of 3868 4004 tmpBD83.tmp.exe 118 PID 4004 wrote to memory of 3868 4004 tmpBD83.tmp.exe 118 PID 4004 wrote to memory of 3868 4004 tmpBD83.tmp.exe 118 PID 3868 wrote to memory of 2360 3868 tmpBD83.tmp.exe 120 PID 3868 wrote to memory of 2360 3868 tmpBD83.tmp.exe 120 PID 3868 wrote to memory of 2360 3868 tmpBD83.tmp.exe 120 PID 2360 wrote to memory of 3204 2360 tmpBD83.tmp.exe 122 PID 2360 wrote to memory of 3204 2360 tmpBD83.tmp.exe 122 PID 2360 wrote to memory of 3204 2360 tmpBD83.tmp.exe 122 PID 3204 wrote to memory of 2104 3204 tmpBD83.tmp.exe 193 PID 3204 wrote to memory of 2104 3204 tmpBD83.tmp.exe 193 PID 3204 wrote to memory of 2104 3204 tmpBD83.tmp.exe 193 PID 2104 wrote to memory of 4408 2104 tmpBD83.tmp.exe 125 PID 2104 wrote to memory of 4408 2104 tmpBD83.tmp.exe 125 PID 2104 wrote to memory of 4408 2104 tmpBD83.tmp.exe 125 PID 4408 wrote to memory of 4716 4408 tmpBD83.tmp.exe 127 PID 4408 wrote to memory of 4716 4408 tmpBD83.tmp.exe 127 PID 4408 wrote to memory of 4716 4408 tmpBD83.tmp.exe 127 PID 4716 wrote to memory of 876 4716 tmpBD83.tmp.exe 198 PID 4716 wrote to memory of 876 4716 tmpBD83.tmp.exe 198 PID 4716 wrote to memory of 876 4716 tmpBD83.tmp.exe 198 PID 876 wrote to memory of 3824 876 tmpBD83.tmp.exe 132 PID 876 wrote to memory of 3824 876 tmpBD83.tmp.exe 132 PID 876 wrote to memory of 3824 876 tmpBD83.tmp.exe 132 PID 3824 wrote to memory of 5112 3824 tmpBD83.tmp.exe 133 PID 3824 wrote to memory of 5112 3824 tmpBD83.tmp.exe 133 PID 3824 wrote to memory of 5112 3824 tmpBD83.tmp.exe 133 PID 5112 wrote to memory of 4184 5112 tmpBD83.tmp.exe 134 PID 5112 wrote to memory of 4184 5112 tmpBD83.tmp.exe 134 PID 5112 wrote to memory of 4184 5112 tmpBD83.tmp.exe 134 PID 4184 wrote to memory of 2948 4184 tmpBD83.tmp.exe 205 PID 4184 wrote to memory of 2948 4184 tmpBD83.tmp.exe 205 PID 4184 wrote to memory of 2948 4184 tmpBD83.tmp.exe 205 PID 2948 wrote to memory of 3196 2948 tmpBD83.tmp.exe 139 PID 2948 wrote to memory of 3196 2948 tmpBD83.tmp.exe 139 PID 2948 wrote to memory of 3196 2948 tmpBD83.tmp.exe 139 PID 3196 wrote to memory of 3352 3196 tmpBD83.tmp.exe 141 PID 3196 wrote to memory of 3352 3196 tmpBD83.tmp.exe 141 PID 3196 wrote to memory of 3352 3196 tmpBD83.tmp.exe 141 PID 3352 wrote to memory of 4840 3352 tmpBD83.tmp.exe 143 PID 3352 wrote to memory of 4840 3352 tmpBD83.tmp.exe 143 PID 3352 wrote to memory of 4840 3352 tmpBD83.tmp.exe 143 PID 4840 wrote to memory of 936 4840 tmpBD83.tmp.exe 144 PID 4840 wrote to memory of 936 4840 tmpBD83.tmp.exe 144 PID 4840 wrote to memory of 936 4840 tmpBD83.tmp.exe 144 PID 936 wrote to memory of 680 936 tmpBD83.tmp.exe 213 PID 936 wrote to memory of 680 936 tmpBD83.tmp.exe 213 PID 936 wrote to memory of 680 936 tmpBD83.tmp.exe 213 PID 680 wrote to memory of 2072 680 tmpBD83.tmp.exe 147 -
System policy modification 1 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sysmon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe"C:\Users\Admin\AppData\Local\Temp\8a8010863859888ac4f08fa9afbda54602dabbbbbcf114b8d51fef0b66be7f93N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"23⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"24⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"25⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"26⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"27⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"28⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"29⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"30⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"31⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"32⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"33⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"34⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"35⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"36⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"37⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"38⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"39⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"40⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"41⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"42⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"43⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"44⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"45⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"46⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"47⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"48⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"49⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"50⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"51⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"52⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"53⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"54⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"55⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"56⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"57⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"58⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"59⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"60⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"61⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"62⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"63⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"64⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"65⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"66⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"67⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"68⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"69⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"70⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"71⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"72⤵
- System Location Discovery: System Language Discovery
PID:680 -
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"74⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"75⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"76⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"77⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"78⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"79⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"80⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"81⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"82⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"83⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"84⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"85⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"86⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"87⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"88⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"89⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"90⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"91⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"92⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"93⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"94⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"95⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"96⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"97⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"98⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"99⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"100⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"101⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"102⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"104⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"105⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"106⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"107⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"108⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"109⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"110⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"111⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"112⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"113⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"114⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"115⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"116⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"117⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"118⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"119⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"120⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBD83.tmp.exe"121⤵PID:5072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-