description	ioc	Process
File created	C:\Windows\system32\FhbQFdJ\xpsrchvw.exe	cmd.exe
File opened for modification	C:\Windows\system32\FhbQFdJ\xpsrchvw.exe	cmd.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\JEwUiFJ.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\MSCFile	Process not Found

pid	Process
2920	rundll32.exe
2920	rundll32.exe
2920	rundll32.exe
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found
1176	Process not Found

description	pid	Process	procid_target
PID 1176 wrote to memory of 2480	1176	Process not Found	28
PID 1176 wrote to memory of 2480	1176	Process not Found	28
PID 1176 wrote to memory of 2480	1176	Process not Found	28
PID 1176 wrote to memory of 2536	1176	Process not Found	29
PID 1176 wrote to memory of 2536	1176	Process not Found	29
PID 1176 wrote to memory of 2536	1176	Process not Found	29
PID 1176 wrote to memory of 2664	1176	Process not Found	33
PID 1176 wrote to memory of 2664	1176	Process not Found	33
PID 1176 wrote to memory of 2664	1176	Process not Found	33
PID 1176 wrote to memory of 2704	1176	Process not Found	34
PID 1176 wrote to memory of 2704	1176	Process not Found	34
PID 1176 wrote to memory of 2704	1176	Process not Found	34
PID 1176 wrote to memory of 676	1176	Process not Found	36
PID 1176 wrote to memory of 676	1176	Process not Found	36
PID 1176 wrote to memory of 676	1176	Process not Found	36
PID 676 wrote to memory of 2932	676	eventvwr.exe	37
PID 676 wrote to memory of 2932	676	eventvwr.exe	37
PID 676 wrote to memory of 2932	676	eventvwr.exe	37
PID 2932 wrote to memory of 2520	2932	cmd.exe	39
PID 2932 wrote to memory of 2520	2932	cmd.exe	39
PID 2932 wrote to memory of 2520	2932	cmd.exe	39
PID 1176 wrote to memory of 1720	1176	Process not Found	40
PID 1176 wrote to memory of 1720	1176	Process not Found	40
PID 1176 wrote to memory of 1720	1176	Process not Found	40
PID 1720 wrote to memory of 816	1720	cmd.exe	42
PID 1720 wrote to memory of 816	1720	cmd.exe	42
PID 1720 wrote to memory of 816	1720	cmd.exe	42
PID 1176 wrote to memory of 2024	1176	Process not Found	43
PID 1176 wrote to memory of 2024	1176	Process not Found	43
PID 1176 wrote to memory of 2024	1176	Process not Found	43
PID 2024 wrote to memory of 1872	2024	cmd.exe	45
PID 2024 wrote to memory of 1872	2024	cmd.exe	45
PID 2024 wrote to memory of 1872	2024	cmd.exe	45
PID 1176 wrote to memory of 2344	1176	Process not Found	46
PID 1176 wrote to memory of 2344	1176	Process not Found	46
PID 1176 wrote to memory of 2344	1176	Process not Found	46
PID 2344 wrote to memory of 2292	2344	cmd.exe	48
PID 2344 wrote to memory of 2292	2344	cmd.exe	48
PID 2344 wrote to memory of 2292	2344	cmd.exe	48
PID 1176 wrote to memory of 1484	1176	Process not Found	49
PID 1176 wrote to memory of 1484	1176	Process not Found	49
PID 1176 wrote to memory of 1484	1176	Process not Found	49
PID 1484 wrote to memory of 596	1484	cmd.exe	51
PID 1484 wrote to memory of 596	1484	cmd.exe	51
PID 1484 wrote to memory of 596	1484	cmd.exe	51
PID 1176 wrote to memory of 1436	1176	Process not Found	52
PID 1176 wrote to memory of 1436	1176	Process not Found	52
PID 1176 wrote to memory of 1436	1176	Process not Found	52
PID 1436 wrote to memory of 1448	1436	cmd.exe	54
PID 1436 wrote to memory of 1448	1436	cmd.exe	54
PID 1436 wrote to memory of 1448	1436	cmd.exe	54
PID 1176 wrote to memory of 1368	1176	Process not Found	55
PID 1176 wrote to memory of 1368	1176	Process not Found	55
PID 1176 wrote to memory of 1368	1176	Process not Found	55
PID 1368 wrote to memory of 896	1368	cmd.exe	57
PID 1368 wrote to memory of 896	1368	cmd.exe	57
PID 1368 wrote to memory of 896	1368	cmd.exe	57

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads