Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 03:49
Behavioral task
behavioral1
Sample
ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe
-
Size
160KB
-
MD5
ed94aca012ef6b6d1405be64a5c21b80
-
SHA1
49cfcf3cc8b14b5ac196043258c69b50f4ab7219
-
SHA256
ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70a
-
SHA512
068b92d9a6d17ed2e25a63346b6608967773f7fdbe4859e235d278c1a92a70724eb89b95db215594442dc57158681014483ae10d39924eebb231637436b99b84
-
SSDEEP
3072:sr85CgOgoku2tn8ZepItrsG4vEFyTS+LGyr85C:k9gOgoV2tn8oorROEFsS+LG69
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0007000000019551-2.dat family_neshta behavioral1/files/0x000700000001955c-15.dat family_neshta behavioral1/files/0x0001000000010315-20.dat family_neshta behavioral1/files/0x0001000000010313-19.dat family_neshta behavioral1/files/0x000400000001033b-18.dat family_neshta behavioral1/files/0x000d000000010685-17.dat family_neshta behavioral1/memory/1444-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2896-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1292-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1700-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1812-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1244-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f77a-142.dat family_neshta behavioral1/memory/2076-132-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1772-131-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7ce-146.dat family_neshta behavioral1/memory/1236-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1716-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/268-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1868-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1668-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1768-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1988-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1556-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2116-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2724-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2548-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2560-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2480-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-345-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1256-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3020-353-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2996-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1272-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1908-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-376-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/660-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1152-385-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2512-384-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1444 svchost.com 2264 CE6676~1.EXE 2812 svchost.com 2896 CE6676~1.EXE 2688 svchost.com 3044 CE6676~1.EXE 1292 svchost.com 2680 CE6676~1.EXE 1700 svchost.com 2520 CE6676~1.EXE 1812 svchost.com 3016 CE6676~1.EXE 1244 svchost.com 2772 CE6676~1.EXE 2076 svchost.com 1772 CE6676~1.EXE 1236 svchost.com 2512 CE6676~1.EXE 2412 svchost.com 1716 CE6676~1.EXE 268 svchost.com 2224 CE6676~1.EXE 1868 svchost.com 1668 CE6676~1.EXE 1492 svchost.com 1768 CE6676~1.EXE 1780 svchost.com 1988 CE6676~1.EXE 1748 svchost.com 2388 CE6676~1.EXE 1556 svchost.com 2608 CE6676~1.EXE 2116 svchost.com 2252 CE6676~1.EXE 2936 svchost.com 2404 CE6676~1.EXE 2240 svchost.com 2876 CE6676~1.EXE 2724 svchost.com 2820 CE6676~1.EXE 2560 svchost.com 2548 CE6676~1.EXE 2784 svchost.com 2480 CE6676~1.EXE 2956 svchost.com 1256 CE6676~1.EXE 3020 svchost.com 2996 CE6676~1.EXE 1272 svchost.com 1908 CE6676~1.EXE 1980 svchost.com 2992 CE6676~1.EXE 660 svchost.com 2500 CE6676~1.EXE 1152 svchost.com 2512 CE6676~1.EXE 2492 svchost.com 448 CE6676~1.EXE 2864 svchost.com 268 CE6676~1.EXE 2224 svchost.com 2012 CE6676~1.EXE 1596 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1444 svchost.com 1444 svchost.com 2812 svchost.com 2812 svchost.com 2688 svchost.com 2688 svchost.com 1292 svchost.com 1292 svchost.com 1700 svchost.com 1700 svchost.com 1812 svchost.com 1812 svchost.com 1244 svchost.com 1244 svchost.com 2076 svchost.com 2076 svchost.com 1236 svchost.com 1236 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 2412 svchost.com 2412 svchost.com 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 268 svchost.com 268 svchost.com 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1868 svchost.com 1868 svchost.com 1492 svchost.com 1492 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1780 svchost.com 1780 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1748 svchost.com 1748 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 1556 svchost.com 1556 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 2116 svchost.com 2116 svchost.com 2936 svchost.com 2936 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 2240 svchost.com 2240 svchost.com 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 2724 svchost.com 2724 svchost.com 2560 svchost.com 2560 svchost.com 2784 svchost.com 2784 svchost.com 2956 svchost.com 2956 svchost.com 3020 svchost.com 3020 svchost.com 1272 svchost.com 1272 svchost.com 1980 svchost.com 1980 svchost.com 660 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com CE6676~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6676~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2124 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 30 PID 2392 wrote to memory of 2124 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 30 PID 2392 wrote to memory of 2124 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 30 PID 2392 wrote to memory of 2124 2392 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 30 PID 2124 wrote to memory of 1444 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 31 PID 2124 wrote to memory of 1444 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 31 PID 2124 wrote to memory of 1444 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 31 PID 2124 wrote to memory of 1444 2124 ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe 31 PID 1444 wrote to memory of 2264 1444 svchost.com 32 PID 1444 wrote to memory of 2264 1444 svchost.com 32 PID 1444 wrote to memory of 2264 1444 svchost.com 32 PID 1444 wrote to memory of 2264 1444 svchost.com 32 PID 2264 wrote to memory of 2812 2264 CE6676~1.EXE 33 PID 2264 wrote to memory of 2812 2264 CE6676~1.EXE 33 PID 2264 wrote to memory of 2812 2264 CE6676~1.EXE 33 PID 2264 wrote to memory of 2812 2264 CE6676~1.EXE 33 PID 2812 wrote to memory of 2896 2812 svchost.com 34 PID 2812 wrote to memory of 2896 2812 svchost.com 34 PID 2812 wrote to memory of 2896 2812 svchost.com 34 PID 2812 wrote to memory of 2896 2812 svchost.com 34 PID 2896 wrote to memory of 2688 2896 CE6676~1.EXE 35 PID 2896 wrote to memory of 2688 2896 CE6676~1.EXE 35 PID 2896 wrote to memory of 2688 2896 CE6676~1.EXE 35 PID 2896 wrote to memory of 2688 2896 CE6676~1.EXE 35 PID 2688 wrote to memory of 3044 2688 svchost.com 36 PID 2688 wrote to memory of 3044 2688 svchost.com 36 PID 2688 wrote to memory of 3044 2688 svchost.com 36 PID 2688 wrote to memory of 3044 2688 svchost.com 36 PID 3044 wrote to memory of 1292 3044 CE6676~1.EXE 37 PID 3044 wrote to memory of 1292 3044 CE6676~1.EXE 37 PID 3044 wrote to memory of 1292 3044 CE6676~1.EXE 37 PID 3044 wrote to memory of 1292 3044 CE6676~1.EXE 37 PID 1292 wrote to memory of 2680 1292 svchost.com 118 PID 1292 wrote to memory of 2680 1292 svchost.com 118 PID 1292 wrote to memory of 2680 1292 svchost.com 118 PID 1292 wrote to memory of 2680 1292 svchost.com 118 PID 2680 wrote to memory of 1700 2680 CE6676~1.EXE 39 PID 2680 wrote to memory of 1700 2680 CE6676~1.EXE 39 PID 2680 wrote to memory of 1700 2680 CE6676~1.EXE 39 PID 2680 wrote to memory of 1700 2680 CE6676~1.EXE 39 PID 1700 wrote to memory of 2520 1700 svchost.com 40 PID 1700 wrote to memory of 2520 1700 svchost.com 40 PID 1700 wrote to memory of 2520 1700 svchost.com 40 PID 1700 wrote to memory of 2520 1700 svchost.com 40 PID 2520 wrote to memory of 1812 2520 CE6676~1.EXE 41 PID 2520 wrote to memory of 1812 2520 CE6676~1.EXE 41 PID 2520 wrote to memory of 1812 2520 CE6676~1.EXE 41 PID 2520 wrote to memory of 1812 2520 CE6676~1.EXE 41 PID 1812 wrote to memory of 3016 1812 svchost.com 125 PID 1812 wrote to memory of 3016 1812 svchost.com 125 PID 1812 wrote to memory of 3016 1812 svchost.com 125 PID 1812 wrote to memory of 3016 1812 svchost.com 125 PID 3016 wrote to memory of 1244 3016 CE6676~1.EXE 43 PID 3016 wrote to memory of 1244 3016 CE6676~1.EXE 43 PID 3016 wrote to memory of 1244 3016 CE6676~1.EXE 43 PID 3016 wrote to memory of 1244 3016 CE6676~1.EXE 43 PID 1244 wrote to memory of 2772 1244 svchost.com 44 PID 1244 wrote to memory of 2772 1244 svchost.com 44 PID 1244 wrote to memory of 2772 1244 svchost.com 44 PID 1244 wrote to memory of 2772 1244 svchost.com 44 PID 2772 wrote to memory of 2076 2772 CE6676~1.EXE 129 PID 2772 wrote to memory of 2076 2772 CE6676~1.EXE 129 PID 2772 wrote to memory of 2076 2772 CE6676~1.EXE 129 PID 2772 wrote to memory of 2076 2772 CE6676~1.EXE 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe"C:\Users\Admin\AppData\Local\Temp\ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\ce667665bc9e83098c06cc2f545a22f5df45c2b596561e7113a60610475fb70aN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE18⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE22⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE24⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE26⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE28⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE30⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE32⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE34⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE36⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE40⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE42⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE46⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE48⤵
- Executes dropped EXE
PID:1256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE50⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE52⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE56⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"57⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE60⤵
- Executes dropped EXE
PID:448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"61⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"63⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE64⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"65⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"67⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE68⤵PID:2168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"69⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE70⤵PID:1736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"71⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE72⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"73⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE74⤵PID:876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"75⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE76⤵PID:1684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"77⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE78⤵PID:2824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"79⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE80⤵PID:2920
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"81⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE82⤵PID:2832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"83⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE84⤵PID:780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE86⤵
- Drops file in Windows directory
PID:2888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"87⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE88⤵PID:2732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"89⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE90⤵PID:2684
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"91⤵
- Drops file in Windows directory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"93⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE94⤵PID:2976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"95⤵
- Drops file in Windows directory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE96⤵
- Drops file in Windows directory
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"97⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE98⤵PID:1960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE100⤵PID:2076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"101⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE102⤵PID:1560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"103⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE104⤵PID:3024
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"105⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE106⤵PID:2148
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE108⤵PID:572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"109⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE110⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"111⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"113⤵
- Drops file in Windows directory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE114⤵PID:576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"115⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE116⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"117⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE118⤵PID:1064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"119⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE120⤵PID:2080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CE6676~1.EXE"121⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-