Analysis
-
max time kernel
110s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 23:17
Behavioral task
behavioral1
Sample
a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe
-
Size
356KB
-
MD5
5cd3caf696a3dbe90c77067537f37380
-
SHA1
51ee9003fa2f40ba67df5bcd49805578d487456a
-
SHA256
a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112
-
SHA512
8dd455b64548ff541a70c6b11767de254336d8f0552547e2af296006d536df41dc1d4fba40b864a8f0d786c2594c64c5c8d61643140fa13e964dc791294b08d2
-
SSDEEP
6144:k9NPDAWKklwXx39oBLohizkvxhlDqJd+9:SsWPlwX2Lov5Hq
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x001000000001924f-4.dat family_neshta behavioral1/files/0x0007000000019261-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/files/0x000f00000001033a-16.dat family_neshta behavioral1/memory/2808-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2916-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2452-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3052-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1508-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2036-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1932-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2392-123-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/304-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1160-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-140.dat family_neshta behavioral1/memory/3056-146-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-142.dat family_neshta behavioral1/memory/2268-145-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1168-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1896-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1680-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/768-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1380-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2556-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1176-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-226-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2792-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1728-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2116-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2484-256-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2824-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/444-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1164-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1692-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2036-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/544-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/304-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/572-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1036-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2340-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/956-376-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2344-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1236-385-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-384-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2808 svchost.com 2916 A02857~1.EXE 2736 svchost.com 2616 A02857~1.EXE 3052 svchost.com 2452 A02857~1.EXE 1508 svchost.com 2748 A02857~1.EXE 2432 svchost.com 2184 A02857~1.EXE 2036 svchost.com 1932 A02857~1.EXE 304 svchost.com 2392 A02857~1.EXE 1876 svchost.com 1160 A02857~1.EXE 3056 svchost.com 2268 A02857~1.EXE 1168 svchost.com 1896 A02857~1.EXE 768 svchost.com 1680 A02857~1.EXE 1380 svchost.com 2556 A02857~1.EXE 2488 svchost.com 2140 A02857~1.EXE 1176 svchost.com 2920 A02857~1.EXE 1728 svchost.com 2792 A02857~1.EXE 2780 svchost.com 2116 A02857~1.EXE 2484 svchost.com 2824 A02857~1.EXE 2572 svchost.com 2524 A02857~1.EXE 1976 svchost.com 444 A02857~1.EXE 2552 svchost.com 2748 A02857~1.EXE 1692 svchost.com 1164 A02857~1.EXE 1884 svchost.com 2036 A02857~1.EXE 544 svchost.com 304 A02857~1.EXE 572 svchost.com 1036 A02857~1.EXE 1712 svchost.com 2316 A02857~1.EXE 1980 svchost.com 2340 A02857~1.EXE 2344 svchost.com 956 A02857~1.EXE 1236 svchost.com 1588 A02857~1.EXE 2536 svchost.com 2476 A02857~1.EXE 1820 svchost.com 1108 A02857~1.EXE 2176 svchost.com 2984 A02857~1.EXE 1068 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2808 svchost.com 2808 svchost.com 2736 svchost.com 2736 svchost.com 3052 svchost.com 3052 svchost.com 1508 svchost.com 1508 svchost.com 2432 svchost.com 2432 svchost.com 2036 svchost.com 2036 svchost.com 304 svchost.com 304 svchost.com 1876 svchost.com 1876 svchost.com 3056 svchost.com 3056 svchost.com 1168 svchost.com 1168 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 768 svchost.com 768 svchost.com 1380 svchost.com 1380 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2488 svchost.com 2488 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 1176 svchost.com 1176 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 1728 svchost.com 1728 svchost.com 2780 svchost.com 2780 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2484 svchost.com 2484 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2572 svchost.com 2572 svchost.com 1976 svchost.com 1976 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 2552 svchost.com 2552 svchost.com 1692 svchost.com 1692 svchost.com 1884 svchost.com 1884 svchost.com 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 544 svchost.com 544 svchost.com 572 svchost.com 572 svchost.com 1712 svchost.com 1712 svchost.com 1980 svchost.com 1980 svchost.com 2344 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com A02857~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys A02857~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A02857~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2812 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 30 PID 2676 wrote to memory of 2812 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 30 PID 2676 wrote to memory of 2812 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 30 PID 2676 wrote to memory of 2812 2676 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 30 PID 2812 wrote to memory of 2808 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 31 PID 2812 wrote to memory of 2808 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 31 PID 2812 wrote to memory of 2808 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 31 PID 2812 wrote to memory of 2808 2812 a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe 31 PID 2808 wrote to memory of 2916 2808 svchost.com 32 PID 2808 wrote to memory of 2916 2808 svchost.com 32 PID 2808 wrote to memory of 2916 2808 svchost.com 32 PID 2808 wrote to memory of 2916 2808 svchost.com 32 PID 2916 wrote to memory of 2736 2916 A02857~1.EXE 33 PID 2916 wrote to memory of 2736 2916 A02857~1.EXE 33 PID 2916 wrote to memory of 2736 2916 A02857~1.EXE 33 PID 2916 wrote to memory of 2736 2916 A02857~1.EXE 33 PID 2736 wrote to memory of 2616 2736 svchost.com 34 PID 2736 wrote to memory of 2616 2736 svchost.com 34 PID 2736 wrote to memory of 2616 2736 svchost.com 34 PID 2736 wrote to memory of 2616 2736 svchost.com 34 PID 2616 wrote to memory of 3052 2616 A02857~1.EXE 35 PID 2616 wrote to memory of 3052 2616 A02857~1.EXE 35 PID 2616 wrote to memory of 3052 2616 A02857~1.EXE 35 PID 2616 wrote to memory of 3052 2616 A02857~1.EXE 35 PID 3052 wrote to memory of 2452 3052 svchost.com 36 PID 3052 wrote to memory of 2452 3052 svchost.com 36 PID 3052 wrote to memory of 2452 3052 svchost.com 36 PID 3052 wrote to memory of 2452 3052 svchost.com 36 PID 2452 wrote to memory of 1508 2452 A02857~1.EXE 37 PID 2452 wrote to memory of 1508 2452 A02857~1.EXE 37 PID 2452 wrote to memory of 1508 2452 A02857~1.EXE 37 PID 2452 wrote to memory of 1508 2452 A02857~1.EXE 37 PID 1508 wrote to memory of 2748 1508 svchost.com 70 PID 1508 wrote to memory of 2748 1508 svchost.com 70 PID 1508 wrote to memory of 2748 1508 svchost.com 70 PID 1508 wrote to memory of 2748 1508 svchost.com 70 PID 2748 wrote to memory of 2432 2748 A02857~1.EXE 39 PID 2748 wrote to memory of 2432 2748 A02857~1.EXE 39 PID 2748 wrote to memory of 2432 2748 A02857~1.EXE 39 PID 2748 wrote to memory of 2432 2748 A02857~1.EXE 39 PID 2432 wrote to memory of 2184 2432 svchost.com 40 PID 2432 wrote to memory of 2184 2432 svchost.com 40 PID 2432 wrote to memory of 2184 2432 svchost.com 40 PID 2432 wrote to memory of 2184 2432 svchost.com 40 PID 2184 wrote to memory of 2036 2184 A02857~1.EXE 74 PID 2184 wrote to memory of 2036 2184 A02857~1.EXE 74 PID 2184 wrote to memory of 2036 2184 A02857~1.EXE 74 PID 2184 wrote to memory of 2036 2184 A02857~1.EXE 74 PID 2036 wrote to memory of 1932 2036 svchost.com 119 PID 2036 wrote to memory of 1932 2036 svchost.com 119 PID 2036 wrote to memory of 1932 2036 svchost.com 119 PID 2036 wrote to memory of 1932 2036 svchost.com 119 PID 1932 wrote to memory of 304 1932 A02857~1.EXE 123 PID 1932 wrote to memory of 304 1932 A02857~1.EXE 123 PID 1932 wrote to memory of 304 1932 A02857~1.EXE 123 PID 1932 wrote to memory of 304 1932 A02857~1.EXE 123 PID 304 wrote to memory of 2392 304 svchost.com 44 PID 304 wrote to memory of 2392 304 svchost.com 44 PID 304 wrote to memory of 2392 304 svchost.com 44 PID 304 wrote to memory of 2392 304 svchost.com 44 PID 2392 wrote to memory of 1876 2392 A02857~1.EXE 169 PID 2392 wrote to memory of 1876 2392 A02857~1.EXE 169 PID 2392 wrote to memory of 1876 2392 A02857~1.EXE 169 PID 2392 wrote to memory of 1876 2392 A02857~1.EXE 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe"C:\Users\Admin\AppData\Local\Temp\a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\a02857c9e35f9e22c687999c820398c12fbff61dbfc0a60061b31f9453743112N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE22⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE24⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE26⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE28⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE30⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE32⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE34⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE36⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE40⤵
- Executes dropped EXE
PID:444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE42⤵
- Executes dropped EXE
PID:2748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE44⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE46⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE48⤵
- Executes dropped EXE
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE50⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE52⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE56⤵
- Executes dropped EXE
PID:956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE58⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"59⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE60⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"61⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE62⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE66⤵PID:1872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"67⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE68⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"69⤵
- Drops file in Windows directory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE70⤵PID:2712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE72⤵
- Drops file in Windows directory
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"73⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"75⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE76⤵PID:2808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"77⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE78⤵PID:2484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"79⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE80⤵PID:2572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"81⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE82⤵PID:408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"83⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE84⤵PID:2960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE86⤵PID:2696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"87⤵
- Drops file in Windows directory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE88⤵PID:1100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"89⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE90⤵PID:2004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"91⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"93⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE94⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"95⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE96⤵PID:644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"97⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE98⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"99⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE100⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE102⤵
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"103⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE104⤵PID:1556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"105⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE106⤵PID:1292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"107⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE108⤵PID:1360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"109⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE110⤵PID:3048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"111⤵
- Drops file in Windows directory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE112⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"113⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE114⤵PID:2072
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"115⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE116⤵PID:2976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"117⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE118⤵PID:2716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"119⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\A02857~1.EXE"121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-