Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 20:34
Behavioral task
behavioral1
Sample
2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe
-
Size
230KB
-
MD5
35ae5712554b07254555a34f4fc456c5
-
SHA1
3be7f2f18ce572890097f42885c33122954980df
-
SHA256
2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499
-
SHA512
6360131a8e995c9f566bbe3455c5f0816df39595dffef4a56d0ed4e2679e78940e49ff24ea1e4a5d7c0f723103e00e0a1c3b084b88e47b8154bd04f13cca2c91
-
SSDEEP
3072:sr85C5xk+WI0opiKyD/IOSfS0GJKqNtmxmAPxhlQeOfjR2cVsr85C:k95xk7ooBo1G7wmApQeON2cVk9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016875-2.dat family_neshta behavioral1/files/0x0001000000010319-19.dat family_neshta behavioral1/files/0x0008000000016b47-20.dat family_neshta behavioral1/files/0x0001000000010317-18.dat family_neshta behavioral1/files/0x0013000000010681-17.dat family_neshta behavioral1/files/0x00100000000106a5-16.dat family_neshta behavioral1/memory/1488-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2908-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2916-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2852-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2336-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2880-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1504-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2024-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f778-127.dat family_neshta behavioral1/files/0x000100000000f7e8-132.dat family_neshta behavioral1/memory/340-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f705-140.dat family_neshta behavioral1/memory/2996-138-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-157-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2288-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/448-181-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1700-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2216-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1508-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2468-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1572-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1488-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2976-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3036-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2956-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2068-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2044-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1652-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2344-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1524-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1516-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1684-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2268-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/484-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 2592 svchost.com 1488 2B77BA~1.EXE 2780 svchost.com 2908 2B77BA~1.EXE 2844 svchost.com 2916 2B77BA~1.EXE 2848 svchost.com 2852 2B77BA~1.EXE 2688 svchost.com 2336 2B77BA~1.EXE 2320 svchost.com 2880 2B77BA~1.EXE 1504 svchost.com 2024 2B77BA~1.EXE 340 svchost.com 2996 2B77BA~1.EXE 2288 svchost.com 1636 2B77BA~1.EXE 448 svchost.com 3004 2B77BA~1.EXE 1864 svchost.com 2040 2B77BA~1.EXE 1700 svchost.com 992 2B77BA~1.EXE 2216 svchost.com 1712 2B77BA~1.EXE 2468 svchost.com 1508 2B77BA~1.EXE 1572 svchost.com 2620 2B77BA~1.EXE 2392 svchost.com 1488 2B77BA~1.EXE 2904 svchost.com 2924 2B77BA~1.EXE 2976 svchost.com 3036 2B77BA~1.EXE 2956 svchost.com 2716 2B77BA~1.EXE 2800 svchost.com 2764 2B77BA~1.EXE 2068 svchost.com 2692 2B77BA~1.EXE 1436 svchost.com 2044 2B77BA~1.EXE 2344 svchost.com 1652 2B77BA~1.EXE 1524 svchost.com 1644 2B77BA~1.EXE 1516 svchost.com 2872 2B77BA~1.EXE 1684 svchost.com 2248 2B77BA~1.EXE 2268 svchost.com 2220 2B77BA~1.EXE 2636 svchost.com 484 2B77BA~1.EXE 584 svchost.com 2624 2B77BA~1.EXE 1688 svchost.com 632 2B77BA~1.EXE 1364 svchost.com 688 2B77BA~1.EXE 1004 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 2592 svchost.com 2592 svchost.com 2780 svchost.com 2780 svchost.com 2844 svchost.com 2844 svchost.com 2848 svchost.com 2848 svchost.com 2688 svchost.com 2688 svchost.com 2320 svchost.com 2320 svchost.com 1504 svchost.com 1504 svchost.com 340 svchost.com 340 svchost.com 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 2288 svchost.com 2288 svchost.com 448 svchost.com 448 svchost.com 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 1864 svchost.com 1864 svchost.com 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 1700 svchost.com 1700 svchost.com 2216 svchost.com 2216 svchost.com 2468 svchost.com 2468 svchost.com 1572 svchost.com 1572 svchost.com 2392 svchost.com 2392 svchost.com 2904 svchost.com 2904 svchost.com 2976 svchost.com 2976 svchost.com 2956 svchost.com 2956 svchost.com 2800 svchost.com 2800 svchost.com 2068 svchost.com 2068 svchost.com 1436 svchost.com 1436 svchost.com 2344 svchost.com 2344 svchost.com 1524 svchost.com 1524 svchost.com 1516 svchost.com 1516 svchost.com 1684 svchost.com 1684 svchost.com 2268 svchost.com 2268 svchost.com 2636 svchost.com 2636 svchost.com 584 svchost.com 584 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys 2B77BA~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B77BA~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 3044 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 30 PID 2064 wrote to memory of 3044 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 30 PID 2064 wrote to memory of 3044 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 30 PID 2064 wrote to memory of 3044 2064 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 30 PID 3044 wrote to memory of 2592 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 31 PID 3044 wrote to memory of 2592 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 31 PID 3044 wrote to memory of 2592 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 31 PID 3044 wrote to memory of 2592 3044 2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe 31 PID 2592 wrote to memory of 1488 2592 svchost.com 62 PID 2592 wrote to memory of 1488 2592 svchost.com 62 PID 2592 wrote to memory of 1488 2592 svchost.com 62 PID 2592 wrote to memory of 1488 2592 svchost.com 62 PID 1488 wrote to memory of 2780 1488 2B77BA~1.EXE 33 PID 1488 wrote to memory of 2780 1488 2B77BA~1.EXE 33 PID 1488 wrote to memory of 2780 1488 2B77BA~1.EXE 33 PID 1488 wrote to memory of 2780 1488 2B77BA~1.EXE 33 PID 2780 wrote to memory of 2908 2780 svchost.com 34 PID 2780 wrote to memory of 2908 2780 svchost.com 34 PID 2780 wrote to memory of 2908 2780 svchost.com 34 PID 2780 wrote to memory of 2908 2780 svchost.com 34 PID 2908 wrote to memory of 2844 2908 2B77BA~1.EXE 35 PID 2908 wrote to memory of 2844 2908 2B77BA~1.EXE 35 PID 2908 wrote to memory of 2844 2908 2B77BA~1.EXE 35 PID 2908 wrote to memory of 2844 2908 2B77BA~1.EXE 35 PID 2844 wrote to memory of 2916 2844 svchost.com 36 PID 2844 wrote to memory of 2916 2844 svchost.com 36 PID 2844 wrote to memory of 2916 2844 svchost.com 36 PID 2844 wrote to memory of 2916 2844 svchost.com 36 PID 2916 wrote to memory of 2848 2916 2B77BA~1.EXE 37 PID 2916 wrote to memory of 2848 2916 2B77BA~1.EXE 37 PID 2916 wrote to memory of 2848 2916 2B77BA~1.EXE 37 PID 2916 wrote to memory of 2848 2916 2B77BA~1.EXE 37 PID 2848 wrote to memory of 2852 2848 svchost.com 38 PID 2848 wrote to memory of 2852 2848 svchost.com 38 PID 2848 wrote to memory of 2852 2848 svchost.com 38 PID 2848 wrote to memory of 2852 2848 svchost.com 38 PID 2852 wrote to memory of 2688 2852 2B77BA~1.EXE 119 PID 2852 wrote to memory of 2688 2852 2B77BA~1.EXE 119 PID 2852 wrote to memory of 2688 2852 2B77BA~1.EXE 119 PID 2852 wrote to memory of 2688 2852 2B77BA~1.EXE 119 PID 2688 wrote to memory of 2336 2688 svchost.com 40 PID 2688 wrote to memory of 2336 2688 svchost.com 40 PID 2688 wrote to memory of 2336 2688 svchost.com 40 PID 2688 wrote to memory of 2336 2688 svchost.com 40 PID 2336 wrote to memory of 2320 2336 2B77BA~1.EXE 41 PID 2336 wrote to memory of 2320 2336 2B77BA~1.EXE 41 PID 2336 wrote to memory of 2320 2336 2B77BA~1.EXE 41 PID 2336 wrote to memory of 2320 2336 2B77BA~1.EXE 41 PID 2320 wrote to memory of 2880 2320 svchost.com 122 PID 2320 wrote to memory of 2880 2320 svchost.com 122 PID 2320 wrote to memory of 2880 2320 svchost.com 122 PID 2320 wrote to memory of 2880 2320 svchost.com 122 PID 2880 wrote to memory of 1504 2880 2B77BA~1.EXE 43 PID 2880 wrote to memory of 1504 2880 2B77BA~1.EXE 43 PID 2880 wrote to memory of 1504 2880 2B77BA~1.EXE 43 PID 2880 wrote to memory of 1504 2880 2B77BA~1.EXE 43 PID 1504 wrote to memory of 2024 1504 svchost.com 44 PID 1504 wrote to memory of 2024 1504 svchost.com 44 PID 1504 wrote to memory of 2024 1504 svchost.com 44 PID 1504 wrote to memory of 2024 1504 svchost.com 44 PID 2024 wrote to memory of 340 2024 2B77BA~1.EXE 45 PID 2024 wrote to memory of 340 2024 2B77BA~1.EXE 45 PID 2024 wrote to memory of 340 2024 2B77BA~1.EXE 45 PID 2024 wrote to memory of 340 2024 2B77BA~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe"C:\Users\Admin\AppData\Local\Temp\2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2b77ba6432246dc22ae07115b8944b11470920f30d4b8e1e421a351609700499.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE18⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE20⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE22⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE34⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE36⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE38⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE40⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE42⤵
- Executes dropped EXE
PID:2764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE44⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE48⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE50⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE52⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE60⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"61⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE62⤵
- Executes dropped EXE
PID:632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"63⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE64⤵
- Executes dropped EXE
PID:688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"65⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE66⤵
- Drops file in Windows directory
PID:2040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"67⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE68⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"69⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE70⤵PID:1924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"71⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE72⤵
- Drops file in Windows directory
PID:892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE74⤵PID:1608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE76⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"77⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE78⤵PID:2620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"79⤵
- Drops file in Windows directory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE80⤵
- Drops file in Windows directory
PID:1032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE82⤵PID:2904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"83⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE84⤵
- Drops file in Windows directory
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"85⤵
- Drops file in Windows directory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE86⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE88⤵PID:2800
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"89⤵
- Drops file in Windows directory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE92⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"93⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE96⤵PID:2184
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"97⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE98⤵PID:1500
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"99⤵
- Drops file in Windows directory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE100⤵PID:2212
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"101⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE102⤵
- Drops file in Windows directory
PID:1480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"103⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE104⤵PID:1096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE106⤵PID:896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"107⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE108⤵PID:2036
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"109⤵
- Drops file in Windows directory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE110⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"111⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE112⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"113⤵
- Drops file in Windows directory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE114⤵
- Drops file in Windows directory
PID:1924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"115⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE116⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE118⤵PID:1512
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"119⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE120⤵PID:2772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2B77BA~1.EXE"121⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-