Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 07:59
Behavioral task
behavioral1
Sample
caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe
-
Size
365KB
-
MD5
28336bd7b647d1ab5915ed0da4fd9c90
-
SHA1
508e3c7f53d7f32dbad9e29b16ad91289164f190
-
SHA256
caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1
-
SHA512
e2753338f61e34a981807b02e436b91b7df7decad2e898f006ab6f82389b76c6fc96cd9e8643e96cf4f646d40209c1e13ff00bb5b03a0a80445ff5e26e237611
-
SSDEEP
6144:k9niwHv5AjJLo2I3p9ojRxAOZSu7dBEJTl1YMsJTl1YM19:y9HujJLYp9Y2OdBo7y7
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0009000000017530-2.dat family_neshta behavioral1/files/0x00080000000175ae-15.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x000100000001064f-18.dat family_neshta behavioral1/files/0x000b000000010326-17.dat family_neshta behavioral1/memory/2836-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3044-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2056-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/828-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/816-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7de-113.dat family_neshta behavioral1/files/0x000100000000f77c-115.dat family_neshta behavioral1/files/0x000100000000f7d0-132.dat family_neshta behavioral1/files/0x000100000000f7ec-135.dat family_neshta behavioral1/memory/2260-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f709-140.dat family_neshta behavioral1/files/0x000100000000f833-144.dat family_neshta behavioral1/memory/1252-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/236-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f834-146.dat family_neshta behavioral1/memory/1952-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-171-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1896-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1356-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1760-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/932-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3024-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2468-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2012-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1240-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/608-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-246-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1544-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2896-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1908-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1816-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1608-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2176-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1784-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/496-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/584-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1092-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1120-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 2836 svchost.com 2712 CAF802~1.EXE 2968 svchost.com 2632 CAF802~1.EXE 2772 svchost.com 2636 CAF802~1.EXE 3044 svchost.com 2948 CAF802~1.EXE 2056 svchost.com 828 CAF802~1.EXE 2940 svchost.com 816 CAF802~1.EXE 2260 svchost.com 2412 CAF802~1.EXE 236 svchost.com 1252 CAF802~1.EXE 1952 svchost.com 2192 CAF802~1.EXE 1896 svchost.com 1960 CAF802~1.EXE 1760 svchost.com 1356 CAF802~1.EXE 932 svchost.com 3024 CAF802~1.EXE 2012 svchost.com 2468 CAF802~1.EXE 608 svchost.com 1240 CAF802~1.EXE 1544 svchost.com 2508 CAF802~1.EXE 2896 svchost.com 1908 CAF802~1.EXE 2280 svchost.com 2808 CAF802~1.EXE 2632 svchost.com 2720 CAF802~1.EXE 2096 svchost.com 1764 CAF802~1.EXE 3056 svchost.com 1816 CAF802~1.EXE 1608 svchost.com 2928 CAF802~1.EXE 2176 svchost.com 2904 CAF802~1.EXE 1784 svchost.com 2420 CAF802~1.EXE 496 svchost.com 584 CAF802~1.EXE 1092 svchost.com 1120 CAF802~1.EXE 2236 svchost.com 1964 CAF802~1.EXE 2248 svchost.com 2104 CAF802~1.EXE 628 svchost.com 1636 CAF802~1.EXE 2212 svchost.com 1812 CAF802~1.EXE 824 svchost.com 1460 CAF802~1.EXE 1760 svchost.com 2360 CAF802~1.EXE 1604 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 2836 svchost.com 2836 svchost.com 2968 svchost.com 2968 svchost.com 2772 svchost.com 2772 svchost.com 3044 svchost.com 3044 svchost.com 2056 svchost.com 2056 svchost.com 2940 svchost.com 2940 svchost.com 2260 svchost.com 2260 svchost.com 236 svchost.com 236 svchost.com 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 1952 svchost.com 1952 svchost.com 1896 svchost.com 1896 svchost.com 1760 svchost.com 1760 svchost.com 932 svchost.com 932 svchost.com 2012 svchost.com 2012 svchost.com 608 svchost.com 608 svchost.com 1544 svchost.com 1544 svchost.com 2896 svchost.com 2896 svchost.com 2280 svchost.com 2280 svchost.com 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 2632 svchost.com 2632 svchost.com 2096 svchost.com 2096 svchost.com 3056 svchost.com 3056 svchost.com 1608 svchost.com 1608 svchost.com 2176 svchost.com 2176 svchost.com 1784 svchost.com 1784 svchost.com 496 svchost.com 496 svchost.com 1092 svchost.com 1092 svchost.com 2236 svchost.com 2236 svchost.com 2248 svchost.com 2248 svchost.com 628 svchost.com 628 svchost.com 2212 svchost.com 2212 svchost.com 824 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CAF802~1.EXE File opened for modification C:\Windows\directx.sys CAF802~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF802~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 468 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 30 PID 1856 wrote to memory of 468 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 30 PID 1856 wrote to memory of 468 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 30 PID 1856 wrote to memory of 468 1856 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 30 PID 468 wrote to memory of 2836 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 31 PID 468 wrote to memory of 2836 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 31 PID 468 wrote to memory of 2836 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 31 PID 468 wrote to memory of 2836 468 caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe 31 PID 2836 wrote to memory of 2712 2836 svchost.com 32 PID 2836 wrote to memory of 2712 2836 svchost.com 32 PID 2836 wrote to memory of 2712 2836 svchost.com 32 PID 2836 wrote to memory of 2712 2836 svchost.com 32 PID 2712 wrote to memory of 2968 2712 CAF802~1.EXE 33 PID 2712 wrote to memory of 2968 2712 CAF802~1.EXE 33 PID 2712 wrote to memory of 2968 2712 CAF802~1.EXE 33 PID 2712 wrote to memory of 2968 2712 CAF802~1.EXE 33 PID 2968 wrote to memory of 2632 2968 svchost.com 65 PID 2968 wrote to memory of 2632 2968 svchost.com 65 PID 2968 wrote to memory of 2632 2968 svchost.com 65 PID 2968 wrote to memory of 2632 2968 svchost.com 65 PID 2632 wrote to memory of 2772 2632 CAF802~1.EXE 35 PID 2632 wrote to memory of 2772 2632 CAF802~1.EXE 35 PID 2632 wrote to memory of 2772 2632 CAF802~1.EXE 35 PID 2632 wrote to memory of 2772 2632 CAF802~1.EXE 35 PID 2772 wrote to memory of 2636 2772 svchost.com 36 PID 2772 wrote to memory of 2636 2772 svchost.com 36 PID 2772 wrote to memory of 2636 2772 svchost.com 36 PID 2772 wrote to memory of 2636 2772 svchost.com 36 PID 2636 wrote to memory of 3044 2636 CAF802~1.EXE 37 PID 2636 wrote to memory of 3044 2636 CAF802~1.EXE 37 PID 2636 wrote to memory of 3044 2636 CAF802~1.EXE 37 PID 2636 wrote to memory of 3044 2636 CAF802~1.EXE 37 PID 3044 wrote to memory of 2948 3044 svchost.com 38 PID 3044 wrote to memory of 2948 3044 svchost.com 38 PID 3044 wrote to memory of 2948 3044 svchost.com 38 PID 3044 wrote to memory of 2948 3044 svchost.com 38 PID 2948 wrote to memory of 2056 2948 CAF802~1.EXE 39 PID 2948 wrote to memory of 2056 2948 CAF802~1.EXE 39 PID 2948 wrote to memory of 2056 2948 CAF802~1.EXE 39 PID 2948 wrote to memory of 2056 2948 CAF802~1.EXE 39 PID 2056 wrote to memory of 828 2056 svchost.com 40 PID 2056 wrote to memory of 828 2056 svchost.com 40 PID 2056 wrote to memory of 828 2056 svchost.com 40 PID 2056 wrote to memory of 828 2056 svchost.com 40 PID 828 wrote to memory of 2940 828 CAF802~1.EXE 41 PID 828 wrote to memory of 2940 828 CAF802~1.EXE 41 PID 828 wrote to memory of 2940 828 CAF802~1.EXE 41 PID 828 wrote to memory of 2940 828 CAF802~1.EXE 41 PID 2940 wrote to memory of 816 2940 svchost.com 122 PID 2940 wrote to memory of 816 2940 svchost.com 122 PID 2940 wrote to memory of 816 2940 svchost.com 122 PID 2940 wrote to memory of 816 2940 svchost.com 122 PID 816 wrote to memory of 2260 816 CAF802~1.EXE 43 PID 816 wrote to memory of 2260 816 CAF802~1.EXE 43 PID 816 wrote to memory of 2260 816 CAF802~1.EXE 43 PID 816 wrote to memory of 2260 816 CAF802~1.EXE 43 PID 2260 wrote to memory of 2412 2260 svchost.com 44 PID 2260 wrote to memory of 2412 2260 svchost.com 44 PID 2260 wrote to memory of 2412 2260 svchost.com 44 PID 2260 wrote to memory of 2412 2260 svchost.com 44 PID 2412 wrote to memory of 236 2412 CAF802~1.EXE 45 PID 2412 wrote to memory of 236 2412 CAF802~1.EXE 45 PID 2412 wrote to memory of 236 2412 CAF802~1.EXE 45 PID 2412 wrote to memory of 236 2412 CAF802~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe"C:\Users\Admin\AppData\Local\Temp\caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\caf802e251fef0e10be1839d32c271be2abf687cdccfa1842baae6c1d51a6af1N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE20⤵
- Executes dropped EXE
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE22⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE24⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE26⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE30⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE32⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE34⤵
- Executes dropped EXE
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE36⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE38⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE40⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE42⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE44⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE48⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE50⤵
- Executes dropped EXE
PID:584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE52⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE54⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE56⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE58⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE60⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE62⤵
- Executes dropped EXE
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"63⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE64⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"65⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE66⤵PID:2068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"67⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE68⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"69⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE70⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"71⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE72⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"73⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE74⤵PID:1968
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"75⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE76⤵PID:2612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"77⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE78⤵PID:2912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"79⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE80⤵PID:2776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"81⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE82⤵PID:2600
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"83⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE84⤵PID:2888
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"87⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE88⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"89⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE90⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE92⤵PID:2164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"93⤵
- Drops file in Windows directory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE94⤵PID:816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE96⤵PID:2244
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"97⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE98⤵PID:2424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"99⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE100⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"101⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE102⤵
- Drops file in Windows directory
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"103⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE104⤵PID:768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"105⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE106⤵
- Drops file in Windows directory
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"107⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE108⤵
- Drops file in Windows directory
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"109⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE110⤵PID:2360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE112⤵
- Drops file in Windows directory
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE114⤵PID:2960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"115⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE116⤵PID:2060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"117⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE118⤵PID:1544
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"119⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE120⤵PID:2340
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CAF802~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-