Malware Analysis Report

2024-12-07 09:57

Sample ID 241114-dt7lnsxmfp
Target f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
SHA256 f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115
Tags
defense_evasion discovery persistence privilege_escalation ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115

Threat Level: Known bad

The file f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery persistence privilege_escalation ransomware

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Deletes itself

Adds Run key to start application

Maps connected drives based on registry

Drops file in Program Files directory

Access Token Manipulation: Create Process with Token

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Program crash

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 03:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 03:19

Reported

2024-11-14 03:21

Platform

win7-20240903-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winupas.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PnWAWNj = "C:\\Users\\Admin\\AppData\\Roaming\\isass.exe" C:\Windows\SysWOW64\mshta.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Assistant = "\"C:\\Users\\Admin\\AppData\\Roaming\\winupas.exe\" x" C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\isass.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\isass.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\UxMVPanhYKpVOXtsRk3oSXcd.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\weather.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\vOIviOGltX0HhyFotboSc23SxVXuQcXp.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\2f0FrX0OwABuG1or9Ez8PEMoGwIyZk7N.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\dT458sZMLQ=EnQnl.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\0WmS38ntTpg2jYWbjeOBBNRsUAuZ00p2.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\VgG1LBw1rU2cGCe9JIEgbQeBOpjFQSh0.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\xZsWwtWNo8Dc54Z87l+ISknLB47d4ZeLm80P7LW=9U+h1UA=YioXkVuv.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\pKMKaBsU5Oa+u4A8UPti=k.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0335112.WMF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\9i0ieLgxZ5a+X+J99FhheTbu+evFqaFi.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\es-ES\hat7bUkJNz4a0aosJfRd+WedgfYrl3G+mWVFnR6a6Qg.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ifyJvYRnk8EeCsqp0JvYy1RaJC7+6Qlk.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01246_.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01295_.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\ZKNHiY7Vljz0vq77YetYPVwvESOqULdvX50RhsrzPNmGxLWT+fgGS9eIOvxKM1bFXBB1IlTnCfYZd37N7a=BZR7qP=4Ff1FcktGvsN3CDhlENO+GZS8.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\85cHgXCprSSSnCR1cXpxfCwUH9BkTFPd.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00462_.WMF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\1MbTWffqoRyADWsnNNlnAr6euMdw9PCB.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\fsY0NNVx8FuHKNwbI7VW8yrF55s.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\+lu3wjfLQfe9IMFm3Jhrz=04Y1rMM4IY.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\s68eMk=Y1lf2k4AcRzD3rSeXM+n9ITzLkIxjg20I+87vQsX5L+lvaeM9mYd02UeALM1C150FRzDvjeHF60IVTTd=MizwsFrpfs33jA.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178459.JPG C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\3id6dkqG8IttqByP.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\oBOBuXTnKZOuQScrWTLUvyOLAsQqYBjH.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\+z6xNiYR0D+cSAoGSKilpVtXAC960YQf.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\E+63EX2Dypl2AxrCnIu8aD6sQqfL8idFBjkwTDOLxqVIE34AmsmP9EtKThnX6aEMvjlegJbDMRIaUcOklifgkGWW9+BAdhK9XuNnwdoT2hXhjle2NF872+NHLB+tneJi9=8yhFXDHoQIJmlsIJYf5zn2ytc.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\yXsHm20I73a=NoyMD3weLFGahcxVKdKgECFnXnhnD9fWHT6Z2U0kSVFm14Hrb4drobhomME3993oJJKIowCxCSe6Y59jCouh37IukoWsBr+ctg1sDyvAstWr46M.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\brJ=X8vI2ECQOSl=leL3UVnufP9JL4.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232393.WMF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\+5QnqCtb7QUozQzWqHqoRl2ZOb4.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151045.WMF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS C:\Users\Admin\AppData\Roaming\isass.exe N/A

Access Token Manipulation: Create Process with Token

defense_evasion privilege_escalation
Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\isass.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winupas.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 2212 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 2212 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 2212 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 2660 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 2660 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 2660 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 2660 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 2660 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 2660 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 2660 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 2660 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 2660 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 2832 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 2832 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 2832 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 2832 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 2196 wrote to memory of 8964 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe
PID 2196 wrote to memory of 8964 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe
PID 2196 wrote to memory of 8964 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe
PID 2196 wrote to memory of 8964 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" "C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" runas

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" "C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Users\Admin\AppData\Roaming\isass.exe

"C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Windows\SysWOW64\mshta.exe

mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe');close()}catch(e){}},10);"

C:\Windows\SysWOW64\mshta.exe

mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('isass.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\PnWAWNj',i);}catch(e){}},10);"

C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe

C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe

C:\Users\Admin\AppData\Roaming\winupas.exe

"C:\Users\Admin\AppData\Roaming\winupas.exe" x

Network

N/A

Files

memory/2212-2-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Roaming\isass.exe

MD5 6456d2c7c6f5ce2c6a3abdf5ec10c8a9
SHA1 4882ee914063914cde8e193a5430789014649aec
SHA256 f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115
SHA512 5076c23c6611ea3764a4697cf240b9e3070b87972152b7659cb6a31aa06a7df365408135d0b1b991b026ee93639b59d7bc449cb39a42d6b59a9797b4a45820e2

memory/2660-10-0x0000000000400000-0x000000000044B000-memory.dmp

\Users\Admin\AppData\Local\Temp\$TMP$001.exe

MD5 6dab0adacbf99a4870eea3ba5e50203c
SHA1 b674453f925202773462ce00499fdb6a9cfe9484
SHA256 e70dc307eaf88429650359397c74ae88663df1cfc05b8e97f80d0bad758986ee
SHA512 cc96a17601b74869b34c08eef7a36376b7889b94f89ae0de4b3c1f07828f9d126250bd2b6c66b1a925faf77d27ba7f0c8001488bfab8d400709e6d820e35c012

memory/2196-24-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-51-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-62-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-69-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-70-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-67-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-66-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-65-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-61-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-59-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-58-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-57-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-56-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-55-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-54-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-53-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-52-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-50-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-49-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-47-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-77-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-78-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-75-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-73-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-72-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-71-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-68-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-80-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-46-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-45-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-44-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-43-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-42-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-41-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-39-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-37-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-35-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-33-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-32-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-31-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-29-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-28-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-26-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-25-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-23-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-22-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-21-0x00000000029A0000-0x00000000029C5000-memory.dmp

memory/2196-20-0x00000000029A0000-0x00000000029C5000-memory.dmp

C:\PLEASE READ.TXT

MD5 5c5fb18438179cd01326d7532917a216
SHA1 516e26b4f767057ca2db4a0716d9eca3c9023f60
SHA256 9ef5313a533034af013b55dd6194dc667754b56a690f480fcf26f52e1c69d616
SHA512 0f901b6d40a93ff205fd9a7d1bf3a356f967f5e7c560fefe496e43c201043e215bb4345191f0153d914b7b82e2e6d9894411b481e9b9ddab85939f82892d3061

C:\Program Files\Common Files\Microsoft Shared\ink\я

MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 03:19

Reported

2024-11-14 03:21

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winupas.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update Assistant = "\"C:\\Users\\Admin\\AppData\\Roaming\\winupas.exe\" x" C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\PnWAWNj = "C:\\Users\\Admin\\AppData\\Roaming\\isass.exe" C:\Windows\SysWOW64\mshta.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\isass.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\isass.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\wrmTnCc16cxu5yFso=xeBgZC.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbUpOutline_22_N.svg C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\spkpSMNPU3BZKES3bONTvPAzI6jijZlFIRw.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\6GVto8Vlh93+EaLHOi8Q+8lmvX=Ds2l9PyG2RcipdwDIFk.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\i2oAmmnO=F++d6sb.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Updater.api C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fi_get.svg C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\BchBYPpi0UIRtwtrSzquecJaCArRpu+jsqY.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\PREVIEW.GIF C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\nzyGNwY5LvYH9=toac0vL7B23YQQkXL+O3I.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\mkoluur+CdB1GE5z.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\Oh9+NB9anxJVUqonrosqQRZEjXe33jTWEro.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\CDTcgw59+yIhSYWNGgHzE2l5NKWMppmEQjd=hsmFYO93wSBC0iTJU5nLZ1LSp2WTaEROl5VX1R0OzmRMKWV7FvLiytFlbrEP7SMJ3NSvpeyxb26L0by1r9IJ.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\comment.svg C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\K6RSgoowm+lxUo2FnoIJ7WoE7xIKzBsIDNYoDsNb.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\dXVd8vjzgc5YGOAm.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\xrmEJYVR9y8DSNBr.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\GJyYZRq7HmDCf+iDq5qIexsG2ClXTGwoCw8TINmggv=esfs+AfZ3jzL74Az7OwBP8UZsSWrk0=Q.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\remove.svg C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\lgeJk2r16ryq=I0vs7D8L51vX9SkESg3.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\xw6P5OpzqyYzGKgzrffV4ey=D8GaNhtgh1I.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\PLEASE READ.TXT C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\я C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png C:\Users\Admin\AppData\Roaming\isass.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\e=iYHHL83fYWC=3vIMNKOl3ufT532TNRWXPhl7dYWTTgp+rmvDF4N+6jGKmerZtRgS+kCCEyI7kWk=JHP+gYjdjc5IFn=4.dati19 C:\Users\Admin\AppData\Roaming\isass.exe N/A

Access Token Manipulation: Create Process with Token

defense_evasion privilege_escalation
Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\isass.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winupas.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\isass.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\isass.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 336 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 336 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 336 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 336 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 336 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 336 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe
PID 5008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 5008 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 5008 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Users\Admin\AppData\Roaming\isass.exe
PID 5008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 5008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 5008 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe C:\Windows\SysWOW64\mshta.exe
PID 4576 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 4576 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 4576 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Windows\SysWOW64\mshta.exe
PID 4576 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 4576 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 4576 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Roaming\isass.exe C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe
PID 4012 wrote to memory of 7724 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe
PID 4012 wrote to memory of 7724 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe
PID 4012 wrote to memory of 7724 N/A C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe C:\Users\Admin\AppData\Roaming\winupas.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" "C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe

"C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" runas

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe" "C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Users\Admin\AppData\Roaming\isass.exe

"C:\Users\Admin\AppData\Roaming\isass.exe"

C:\Windows\SysWOW64\mshta.exe

mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115.exe');close()}catch(e){}},10);"

C:\Windows\SysWOW64\mshta.exe

mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('isass.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\PnWAWNj',i);}catch(e){}},10);"

C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe

C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe

C:\Users\Admin\AppData\Roaming\winupas.exe

"C:\Users\Admin\AppData\Roaming\winupas.exe" x

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 984

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/336-2-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Roaming\isass.exe

MD5 6456d2c7c6f5ce2c6a3abdf5ec10c8a9
SHA1 4882ee914063914cde8e193a5430789014649aec
SHA256 f30fb748ce4aaf203383bcfee0ff56b7de189f12b2f7c215304870acd6448115
SHA512 5076c23c6611ea3764a4697cf240b9e3070b87972152b7659cb6a31aa06a7df365408135d0b1b991b026ee93639b59d7bc449cb39a42d6b59a9797b4a45820e2

memory/5008-8-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$TMP$001.exe

MD5 6dab0adacbf99a4870eea3ba5e50203c
SHA1 b674453f925202773462ce00499fdb6a9cfe9484
SHA256 e70dc307eaf88429650359397c74ae88663df1cfc05b8e97f80d0bad758986ee
SHA512 cc96a17601b74869b34c08eef7a36376b7889b94f89ae0de4b3c1f07828f9d126250bd2b6c66b1a925faf77d27ba7f0c8001488bfab8d400709e6d820e35c012

memory/4012-13-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-24-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-45-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-43-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-73-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-72-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-71-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-70-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-69-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-68-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-67-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-66-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-65-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-42-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-41-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-40-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-39-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-38-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-37-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-35-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-33-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-34-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-36-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-32-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-31-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-30-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-29-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-28-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-27-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-26-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-25-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-23-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-22-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-21-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-20-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-19-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-18-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-17-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-16-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-15-0x0000000002270000-0x0000000002295000-memory.dmp

memory/4012-14-0x0000000002270000-0x0000000002295000-memory.dmp

C:\PLEASE READ.TXT

MD5 5bde86bedd9da5b977c3bbdf48046cfe
SHA1 995a8dd89524f6d81282b532c9c4c853cc05cdc6
SHA256 1169fb7c353b15bb3c7c22b21f6e152f0d6f48dccde5e6e10a18fac544b072f1
SHA512 a7dcd71115120c093397afa1067e15fc051a602772d4ed00cae6347f5a55957212a3a2932bcc3d009da751f23dadd93876447d264c9f04053ad9dabe5265fb95

C:\Program Files\Common Files\microsoft shared\ClickToRun\я

MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee