Analysis
-
max time kernel
58s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-11-2024 04:53
Behavioral task
behavioral1
Sample
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe
-
Size
136KB
-
MD5
cec1b6eeedbcb3ca65a2693ed8168b10
-
SHA1
787fc47857bfc960ce6dbe0adc4927bfa38f72ee
-
SHA256
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786
-
SHA512
5a019f19ede30d5dce140b991f4c96afa9fe953216cf148bb015718ebe3ed93dd6787e1c50a9d7532fc61b7773df84caa709d2a6b46e018705cc36c405f95937
-
SSDEEP
1536:JxqjQ+P04wsmJCtQy0qEF0+nMSzG4pqSbi6y2xn0mOxqjQ+P04wsmJC:sr85CtQy0qEF0+nLi44Sbi6yE0cr85C
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
Processes:
resource yara_rule behavioral1/files/0x000700000001868b-2.dat family_neshta behavioral1/files/0x00070000000186f2-16.dat family_neshta behavioral1/files/0x0009000000010663-18.dat family_neshta behavioral1/files/0x0001000000010314-21.dat family_neshta behavioral1/files/0x0001000000010312-20.dat family_neshta behavioral1/files/0x0029000000010667-17.dat family_neshta behavioral1/memory/2656-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-47-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2536-46-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-63-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-77-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1440-91-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-92-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/684-107-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d7-117.dat family_neshta behavioral1/files/0x000100000000f7e5-125.dat family_neshta behavioral1/files/0x000100000000f702-131.dat family_neshta behavioral1/files/0x000100000000f82c-132.dat family_neshta behavioral1/memory/2004-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2172-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1540-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/564-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2464-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2496-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/276-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/484-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2544-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2300-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2336-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2196-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2160-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2380-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2008-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2452-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2624-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/320-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/332-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-381-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1200-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exesvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.compid Process 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2656 svchost.com 2300 0B881E~1.EXE 2744 svchost.com 2536 0B881E~1.EXE 2644 svchost.com 2000 0B881E~1.EXE 2968 svchost.com 2380 0B881E~1.EXE 2488 svchost.com 1440 0B881E~1.EXE 2844 svchost.com 684 0B881E~1.EXE 2836 svchost.com 2004 0B881E~1.EXE 2396 svchost.com 2252 0B881E~1.EXE 1608 svchost.com 2172 0B881E~1.EXE 564 svchost.com 1540 0B881E~1.EXE 2072 svchost.com 2464 0B881E~1.EXE 2432 svchost.com 2496 0B881E~1.EXE 484 svchost.com 276 0B881E~1.EXE 1584 svchost.com 2752 0B881E~1.EXE 2640 svchost.com 2544 0B881E~1.EXE 2300 svchost.com 2584 0B881E~1.EXE 2588 svchost.com 2336 0B881E~1.EXE 1820 svchost.com 2196 0B881E~1.EXE 2160 svchost.com 2380 0B881E~1.EXE 2812 svchost.com 2332 0B881E~1.EXE 2488 svchost.com 2264 0B881E~1.EXE 2508 svchost.com 2008 0B881E~1.EXE 1308 svchost.com 2452 0B881E~1.EXE 320 svchost.com 2624 0B881E~1.EXE 332 svchost.com 2092 0B881E~1.EXE 2148 svchost.com 2740 0B881E~1.EXE 2504 svchost.com 1200 0B881E~1.EXE 1040 svchost.com 2372 0B881E~1.EXE 1240 svchost.com 980 0B881E~1.EXE 1616 svchost.com 1668 0B881E~1.EXE 776 svchost.com 552 0B881E~1.EXE 2392 svchost.com -
Loads dropped DLL 64 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exesvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.compid Process 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2656 svchost.com 2656 svchost.com 2300 0B881E~1.EXE 2744 svchost.com 2744 svchost.com 2536 0B881E~1.EXE 2644 svchost.com 2644 svchost.com 2000 0B881E~1.EXE 2968 svchost.com 2968 svchost.com 2380 0B881E~1.EXE 2488 svchost.com 2488 svchost.com 1440 0B881E~1.EXE 2844 svchost.com 2844 svchost.com 684 0B881E~1.EXE 2836 svchost.com 2836 svchost.com 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2004 0B881E~1.EXE 2396 svchost.com 2396 svchost.com 2252 0B881E~1.EXE 1608 svchost.com 1608 svchost.com 2172 0B881E~1.EXE 564 svchost.com 564 svchost.com 1540 0B881E~1.EXE 2072 svchost.com 2072 svchost.com 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2464 0B881E~1.EXE 2432 svchost.com 2432 svchost.com 2496 0B881E~1.EXE 484 svchost.com 484 svchost.com 276 0B881E~1.EXE 1584 svchost.com 1584 svchost.com 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 2752 0B881E~1.EXE 2640 svchost.com 2640 svchost.com 2544 0B881E~1.EXE 2300 svchost.com 2300 svchost.com 2584 0B881E~1.EXE 2588 svchost.com 2588 svchost.com 2336 0B881E~1.EXE 1820 svchost.com 1820 svchost.com 2196 0B881E~1.EXE 2160 svchost.com 2160 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exedescription ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe -
Drops file in Windows directory 64 IoCs
Processes:
0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comsvchost.com0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comdescription ioc Process File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\svchost.com 0B881E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.comsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.com0B881E~1.EXEsvchost.comsvchost.comsvchost.comsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXE0B881E~1.EXEsvchost.comsvchost.comdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0B881E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe -
Processes:
0B881E~1.EXEdescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 0B881E~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 0B881E~1.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 0B881E~1.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 0B881E~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exesvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEsvchost.com0B881E~1.EXEdescription pid Process procid_target PID 1964 wrote to memory of 2716 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 30 PID 1964 wrote to memory of 2716 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 30 PID 1964 wrote to memory of 2716 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 30 PID 1964 wrote to memory of 2716 1964 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 30 PID 2716 wrote to memory of 2656 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 31 PID 2716 wrote to memory of 2656 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 31 PID 2716 wrote to memory of 2656 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 31 PID 2716 wrote to memory of 2656 2716 0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe 31 PID 2656 wrote to memory of 2300 2656 svchost.com 32 PID 2656 wrote to memory of 2300 2656 svchost.com 32 PID 2656 wrote to memory of 2300 2656 svchost.com 32 PID 2656 wrote to memory of 2300 2656 svchost.com 32 PID 2300 wrote to memory of 2744 2300 0B881E~1.EXE 33 PID 2300 wrote to memory of 2744 2300 0B881E~1.EXE 33 PID 2300 wrote to memory of 2744 2300 0B881E~1.EXE 33 PID 2300 wrote to memory of 2744 2300 0B881E~1.EXE 33 PID 2744 wrote to memory of 2536 2744 svchost.com 34 PID 2744 wrote to memory of 2536 2744 svchost.com 34 PID 2744 wrote to memory of 2536 2744 svchost.com 34 PID 2744 wrote to memory of 2536 2744 svchost.com 34 PID 2536 wrote to memory of 2644 2536 0B881E~1.EXE 35 PID 2536 wrote to memory of 2644 2536 0B881E~1.EXE 35 PID 2536 wrote to memory of 2644 2536 0B881E~1.EXE 35 PID 2536 wrote to memory of 2644 2536 0B881E~1.EXE 35 PID 2644 wrote to memory of 2000 2644 svchost.com 36 PID 2644 wrote to memory of 2000 2644 svchost.com 36 PID 2644 wrote to memory of 2000 2644 svchost.com 36 PID 2644 wrote to memory of 2000 2644 svchost.com 36 PID 2000 wrote to memory of 2968 2000 0B881E~1.EXE 37 PID 2000 wrote to memory of 2968 2000 0B881E~1.EXE 37 PID 2000 wrote to memory of 2968 2000 0B881E~1.EXE 37 PID 2000 wrote to memory of 2968 2000 0B881E~1.EXE 37 PID 2968 wrote to memory of 2380 2968 svchost.com 68 PID 2968 wrote to memory of 2380 2968 svchost.com 68 PID 2968 wrote to memory of 2380 2968 svchost.com 68 PID 2968 wrote to memory of 2380 2968 svchost.com 68 PID 2380 wrote to memory of 2488 2380 0B881E~1.EXE 71 PID 2380 wrote to memory of 2488 2380 0B881E~1.EXE 71 PID 2380 wrote to memory of 2488 2380 0B881E~1.EXE 71 PID 2380 wrote to memory of 2488 2380 0B881E~1.EXE 71 PID 2488 wrote to memory of 1440 2488 svchost.com 40 PID 2488 wrote to memory of 1440 2488 svchost.com 40 PID 2488 wrote to memory of 1440 2488 svchost.com 40 PID 2488 wrote to memory of 1440 2488 svchost.com 40 PID 1440 wrote to memory of 2844 1440 0B881E~1.EXE 41 PID 1440 wrote to memory of 2844 1440 0B881E~1.EXE 41 PID 1440 wrote to memory of 2844 1440 0B881E~1.EXE 41 PID 1440 wrote to memory of 2844 1440 0B881E~1.EXE 41 PID 2844 wrote to memory of 684 2844 svchost.com 42 PID 2844 wrote to memory of 684 2844 svchost.com 42 PID 2844 wrote to memory of 684 2844 svchost.com 42 PID 2844 wrote to memory of 684 2844 svchost.com 42 PID 684 wrote to memory of 2836 684 0B881E~1.EXE 43 PID 684 wrote to memory of 2836 684 0B881E~1.EXE 43 PID 684 wrote to memory of 2836 684 0B881E~1.EXE 43 PID 684 wrote to memory of 2836 684 0B881E~1.EXE 43 PID 2836 wrote to memory of 2004 2836 svchost.com 44 PID 2836 wrote to memory of 2004 2836 svchost.com 44 PID 2836 wrote to memory of 2004 2836 svchost.com 44 PID 2836 wrote to memory of 2004 2836 svchost.com 44 PID 2004 wrote to memory of 2396 2004 0B881E~1.EXE 45 PID 2004 wrote to memory of 2396 2004 0B881E~1.EXE 45 PID 2004 wrote to memory of 2396 2004 0B881E~1.EXE 45 PID 2004 wrote to memory of 2396 2004 0B881E~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe"C:\Users\Admin\AppData\Local\Temp\0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0b881e65b83b9650eb65a68102bb4aeebfd0813cc55e92b21f06b404fecc6786N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE36⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE40⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"41⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE42⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"43⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE44⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"45⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE46⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"49⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE50⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"51⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE52⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"53⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE54⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"55⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE56⤵
- Executes dropped EXE
PID:1200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE58⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"59⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE60⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"61⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"63⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE64⤵
- Executes dropped EXE
PID:552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"65⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE66⤵PID:2140
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"67⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"69⤵
- Drops file in Windows directory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE70⤵PID:660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"71⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE72⤵PID:276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"73⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE74⤵PID:2880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"75⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE76⤵PID:2712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"77⤵
- Drops file in Windows directory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE78⤵PID:2520
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"79⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"81⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE82⤵PID:860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"83⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE84⤵PID:1820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"85⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE86⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"87⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE88⤵PID:2420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"89⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE90⤵PID:1496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"91⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE92⤵
- Drops file in Windows directory
PID:2864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"93⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE94⤵PID:492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"97⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE98⤵PID:2208
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"99⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE100⤵PID:2740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE102⤵PID:2080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE104⤵PID:2384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"105⤵
- Drops file in Windows directory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE106⤵PID:1280
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"107⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE108⤵PID:1940
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"109⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE110⤵PID:2888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"111⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE112⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"113⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE114⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"115⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE116⤵PID:484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"117⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE118⤵PID:1640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"119⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE120⤵PID:2780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\0B881E~1.EXE"121⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-