Analysis
-
max time kernel
54s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 02:10
Behavioral task
behavioral1
Sample
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe
Resource
win7-20240903-en
General
-
Target
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe
-
Size
2.3MB
-
MD5
c2178d8b3bdcf1210181170012e95b83
-
SHA1
1a6e51b004c5384c0af7882229f6a949395d588a
-
SHA256
1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1
-
SHA512
c99ca875c22893d98bbb11fd70eacbad3e180e78f55abc9421db350db91c58428b52398678db0ccbfe9942ce9bf2775a61af9f1d709ca87c7f08c8b62c45fa5a
-
SSDEEP
24576:dFbkIsaPiXSVnC7Yp9zkNmZG8RRln4yzrIila8CfcX50Kew+IVWQPYwKBdzuyMrt:dREXSVMDi3w0aFIP+DwKnwhFltZ
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x000b000000023b8b-4.dat family_neshta behavioral2/files/0x0008000000023ba9-27.dat family_neshta behavioral2/files/0x000b000000023b8f-42.dat family_neshta behavioral2/memory/4536-49-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0004000000020358-54.dat family_neshta behavioral2/memory/1832-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000400000002034b-73.dat family_neshta behavioral2/files/0x000400000002035d-79.dat family_neshta behavioral2/memory/4916-83-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5008-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5012-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0002000000020322-100.dat family_neshta behavioral2/files/0x00010000000214f0-113.dat family_neshta behavioral2/files/0x00010000000214ef-112.dat family_neshta behavioral2/files/0x00010000000214ee-111.dat family_neshta behavioral2/files/0x0001000000022f2d-118.dat family_neshta behavioral2/files/0x0001000000022f31-117.dat family_neshta behavioral2/files/0x0001000000022f70-126.dat family_neshta behavioral2/memory/4080-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000016804-140.dat family_neshta behavioral2/files/0x00010000000167cd-143.dat family_neshta behavioral2/files/0x0001000000016807-152.dat family_neshta behavioral2/memory/1816-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000167c5-156.dat family_neshta behavioral2/files/0x00010000000167eb-155.dat family_neshta behavioral2/files/0x00010000000167ec-154.dat family_neshta behavioral2/files/0x00010000000167c7-153.dat family_neshta behavioral2/memory/5040-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0001000000022e8a-206.dat family_neshta behavioral2/files/0x00020000000215dd-209.dat family_neshta behavioral2/files/0x000300000001e899-211.dat family_neshta behavioral2/files/0x000500000001e45c-210.dat family_neshta behavioral2/files/0x000200000000072b-208.dat family_neshta behavioral2/files/0x0001000000022e86-205.dat family_neshta behavioral2/files/0x0001000000016972-204.dat family_neshta behavioral2/files/0x0001000000016916-203.dat family_neshta behavioral2/files/0x0001000000016924-202.dat family_neshta behavioral2/files/0x000100000001691b-201.dat family_neshta behavioral2/files/0x0001000000016915-200.dat family_neshta behavioral2/files/0x0001000000016919-199.dat family_neshta behavioral2/files/0x0001000000016917-198.dat family_neshta behavioral2/files/0x000100000001dbcb-197.dat family_neshta behavioral2/memory/3732-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3608-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2172-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3024-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1684-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4632-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3500-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3760-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3664-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4664-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3028-257-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4424-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2116-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2196-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1208-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1228-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4896-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/920-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5052-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4556-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3012-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2828-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b99-17.dat family_gh0strat -
Gh0strat family
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240630062.bat" look2.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation HD_1D5~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 1980 look2.exe 1644 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 4536 svchost.com 1832 HD_1D5~1.EXE 4916 svchost.com 5008 HD_1D5~1.EXE 5012 svchost.com 4080 HD_1D5~1.EXE 1816 svchost.com 5040 HD_1D5~1.EXE 3732 svchost.com 3608 HD_1D5~1.EXE 2172 svchost.com 3024 HD_1D5~1.EXE 2168 svchcst.exe 1684 svchost.com 4632 HD_1D5~1.EXE 3500 svchost.com 3760 HD_1D5~1.EXE 3664 svchost.com 4664 HD_1D5~1.EXE 3028 svchost.com 4424 HD_1D5~1.EXE 2116 svchost.com 2196 HD_1D5~1.EXE 1208 svchost.com 1228 HD_1D5~1.EXE 4896 svchost.com 920 HD_1D5~1.EXE 5052 svchost.com 4556 HD_1D5~1.EXE 3012 svchost.com 2828 HD_1D5~1.EXE 2468 svchost.com 2832 HD_1D5~1.EXE 4864 svchost.com 2272 HD_1D5~1.EXE 884 svchost.com 5040 HD_1D5~1.EXE 3564 svchost.com 3016 HD_1D5~1.EXE 4808 svchost.com 3292 HD_1D5~1.EXE 3024 svchost.com 2632 HD_1D5~1.EXE 4632 svchost.com 1092 HD_1D5~1.EXE 4652 svchost.com 3664 HD_1D5~1.EXE 1868 svchost.com 860 HD_1D5~1.EXE 636 svchost.com 408 HD_1D5~1.EXE 4900 svchost.com 1768 HD_1D5~1.EXE 4264 svchost.com 1528 HD_1D5~1.EXE 5064 svchost.com 4556 HD_1D5~1.EXE 1356 svchost.com 1048 HD_1D5~1.EXE 4036 svchost.com 4172 HD_1D5~1.EXE -
Loads dropped DLL 3 IoCs
pid Process 1980 look2.exe 3908 svchost.exe 2168 svchcst.exe -
Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" HD_1D5~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" HD_1D5~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" HD_1D5~1.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\240630062.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe HD_1D5~1.EXE File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe HD_1D5~1.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE File opened for modification C:\Windows\directx.sys HD_1D5~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_1D5~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ HD_1D5~1.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings HD_1D5~1.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 4612 2844 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 83 PID 2844 wrote to memory of 4612 2844 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 83 PID 2844 wrote to memory of 4612 2844 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 83 PID 4612 wrote to memory of 1980 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 84 PID 4612 wrote to memory of 1980 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 84 PID 4612 wrote to memory of 1980 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 84 PID 4612 wrote to memory of 1644 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 87 PID 4612 wrote to memory of 1644 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 87 PID 4612 wrote to memory of 1644 4612 1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 87 PID 1644 wrote to memory of 4536 1644 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 88 PID 1644 wrote to memory of 4536 1644 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 88 PID 1644 wrote to memory of 4536 1644 HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe 88 PID 4536 wrote to memory of 1832 4536 svchost.com 89 PID 4536 wrote to memory of 1832 4536 svchost.com 89 PID 4536 wrote to memory of 1832 4536 svchost.com 89 PID 1832 wrote to memory of 4916 1832 HD_1D5~1.EXE 90 PID 1832 wrote to memory of 4916 1832 HD_1D5~1.EXE 90 PID 1832 wrote to memory of 4916 1832 HD_1D5~1.EXE 90 PID 4916 wrote to memory of 5008 4916 svchost.com 91 PID 4916 wrote to memory of 5008 4916 svchost.com 91 PID 4916 wrote to memory of 5008 4916 svchost.com 91 PID 5008 wrote to memory of 5012 5008 HD_1D5~1.EXE 92 PID 5008 wrote to memory of 5012 5008 HD_1D5~1.EXE 92 PID 5008 wrote to memory of 5012 5008 HD_1D5~1.EXE 92 PID 5012 wrote to memory of 4080 5012 svchost.com 93 PID 5012 wrote to memory of 4080 5012 svchost.com 93 PID 5012 wrote to memory of 4080 5012 svchost.com 93 PID 4080 wrote to memory of 1816 4080 HD_1D5~1.EXE 94 PID 4080 wrote to memory of 1816 4080 HD_1D5~1.EXE 94 PID 4080 wrote to memory of 1816 4080 HD_1D5~1.EXE 94 PID 1816 wrote to memory of 5040 1816 svchost.com 129 PID 1816 wrote to memory of 5040 1816 svchost.com 129 PID 1816 wrote to memory of 5040 1816 svchost.com 129 PID 5040 wrote to memory of 3732 5040 HD_1D5~1.EXE 96 PID 5040 wrote to memory of 3732 5040 HD_1D5~1.EXE 96 PID 5040 wrote to memory of 3732 5040 HD_1D5~1.EXE 96 PID 3732 wrote to memory of 3608 3732 svchost.com 97 PID 3732 wrote to memory of 3608 3732 svchost.com 97 PID 3732 wrote to memory of 3608 3732 svchost.com 97 PID 3608 wrote to memory of 2172 3608 HD_1D5~1.EXE 98 PID 3608 wrote to memory of 2172 3608 HD_1D5~1.EXE 98 PID 3608 wrote to memory of 2172 3608 HD_1D5~1.EXE 98 PID 2172 wrote to memory of 3024 2172 svchost.com 136 PID 2172 wrote to memory of 3024 2172 svchost.com 136 PID 2172 wrote to memory of 3024 2172 svchost.com 136 PID 3908 wrote to memory of 2168 3908 svchost.exe 100 PID 3908 wrote to memory of 2168 3908 svchost.exe 100 PID 3908 wrote to memory of 2168 3908 svchost.exe 100 PID 3024 wrote to memory of 1684 3024 HD_1D5~1.EXE 101 PID 3024 wrote to memory of 1684 3024 HD_1D5~1.EXE 101 PID 3024 wrote to memory of 1684 3024 HD_1D5~1.EXE 101 PID 1684 wrote to memory of 4632 1684 svchost.com 138 PID 1684 wrote to memory of 4632 1684 svchost.com 138 PID 1684 wrote to memory of 4632 1684 svchost.com 138 PID 4632 wrote to memory of 3500 4632 HD_1D5~1.EXE 103 PID 4632 wrote to memory of 3500 4632 HD_1D5~1.EXE 103 PID 4632 wrote to memory of 3500 4632 HD_1D5~1.EXE 103 PID 3500 wrote to memory of 3760 3500 svchost.com 104 PID 3500 wrote to memory of 3760 3500 svchost.com 104 PID 3500 wrote to memory of 3760 3500 svchost.com 104 PID 3760 wrote to memory of 3664 3760 HD_1D5~1.EXE 141 PID 3760 wrote to memory of 3664 3760 HD_1D5~1.EXE 141 PID 3760 wrote to memory of 3664 3760 HD_1D5~1.EXE 141 PID 3664 wrote to memory of 4664 3664 svchost.com 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"C:\Users\Admin\AppData\Local\Temp\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exeC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1d56622a3c6d280fc8d01051e201e6258265491d08ed387a4910d4663fb707a1.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"20⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"22⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE25⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2196 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"26⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"30⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"34⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"36⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:3292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"44⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"46⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
PID:1092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE49⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE53⤵
- Checks computer location settings
- Executes dropped EXE
PID:408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE55⤵
- Executes dropped EXE
- Modifies registry class
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"56⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE57⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:1528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE59⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE61⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"62⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE63⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"64⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE65⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"66⤵
- Drops file in Windows directory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE67⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"68⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE69⤵
- Checks computer location settings
- Modifies registry class
PID:2060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"70⤵
- Drops file in Windows directory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE71⤵
- Checks computer location settings
- Modifies registry class
PID:3628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"72⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE73⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"74⤵
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE75⤵
- System Location Discovery: System Language Discovery
PID:3412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"76⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE77⤵
- Checks computer location settings
- Modifies registry class
PID:3404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"78⤵
- Drops file in Windows directory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE79⤵
- Checks computer location settings
PID:4724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"80⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE81⤵
- Checks computer location settings
- Drops file in Windows directory
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"82⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE83⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"84⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE85⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"86⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE87⤵
- Checks computer location settings
- Modifies registry class
PID:2144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"88⤵
- System Location Discovery: System Language Discovery
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE89⤵
- Checks computer location settings
- Modifies registry class
PID:812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"90⤵
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE91⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"92⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE93⤵
- Modifies registry class
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"94⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE95⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"96⤵
- Drops file in Windows directory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE97⤵
- Checks computer location settings
- Modifies registry class
PID:2340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"98⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE99⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"100⤵
- Drops file in Windows directory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE101⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"102⤵
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE103⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"104⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE105⤵
- Modifies registry class
PID:4516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"106⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE107⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"108⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE109⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"110⤵
- System Location Discovery: System Language Discovery
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE111⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:3672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"112⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE113⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"114⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE115⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:4072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"116⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE117⤵
- Checks computer location settings
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"118⤵
- Drops file in Windows directory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE119⤵
- Checks computer location settings
- Drops file in Windows directory
PID:692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"120⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE121⤵
- Checks computer location settings
- Drops file in Windows directory
PID:4396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\HD_1D5~1.EXE"122⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-