Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 00:57
Behavioral task
behavioral1
Sample
98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe
-
Size
150KB
-
MD5
32f359a354382e547458d2e22b49e736
-
SHA1
ee37cb6d361467d2831cc893c6a8488a35998537
-
SHA256
98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c
-
SHA512
e887ebea2b3fa05191586dd454f0b319a0c8c4989919b50252b17e2bb65512c93d9e731d3c6aaf2c1b9884ca5ae6f78647662f067612bc403e8542f1d7cdcd5c
-
SSDEEP
3072:sr85CNYC16JxUN5PhGgYqqkQFWzKVzMezr85C:k9NYA5PhGPqCFWzKVzMeP9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0007000000016d29-4.dat family_neshta behavioral1/files/0x000b000000010326-17.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x000100000001064f-18.dat family_neshta behavioral1/files/0x0007000000016d31-16.dat family_neshta behavioral1/memory/2624-39-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-38-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2544-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3024-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/564-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2884-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2812-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1432-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1536-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2040-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1176-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f77c-114.dat family_neshta behavioral1/memory/988-120-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-119-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f709-137.dat family_neshta behavioral1/memory/2296-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3060-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2136-171-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/344-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2948-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/524-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1652-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1428-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-247-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3020-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1404-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2600-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2028-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1928-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2032-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1244-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2328-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/264-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1528-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2384-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2312-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2368-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1680-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1016-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2256-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/828-382-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3060-381-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1780-394-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1008-395-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-398-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/892-397-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 2740 svchost.com 2624 98FB78~1.EXE 2688 svchost.com 2544 98FB78~1.EXE 3024 svchost.com 564 98FB78~1.EXE 2812 svchost.com 2884 98FB78~1.EXE 1432 svchost.com 1536 98FB78~1.EXE 2040 svchost.com 1176 98FB78~1.EXE 2732 svchost.com 988 98FB78~1.EXE 2508 svchost.com 2296 98FB78~1.EXE 3060 svchost.com 2136 98FB78~1.EXE 344 svchost.com 1864 98FB78~1.EXE 524 svchost.com 2948 98FB78~1.EXE 1652 svchost.com 2944 98FB78~1.EXE 1428 svchost.com 2108 98FB78~1.EXE 2736 svchost.com 3020 98FB78~1.EXE 2600 svchost.com 1404 98FB78~1.EXE 2232 svchost.com 2568 98FB78~1.EXE 2612 svchost.com 2704 98FB78~1.EXE 2412 svchost.com 2028 98FB78~1.EXE 1928 svchost.com 2032 98FB78~1.EXE 2328 svchost.com 1244 98FB78~1.EXE 264 svchost.com 1528 98FB78~1.EXE 2384 svchost.com 2920 98FB78~1.EXE 2312 svchost.com 2368 98FB78~1.EXE 1680 svchost.com 1948 98FB78~1.EXE 2256 svchost.com 1016 98FB78~1.EXE 828 svchost.com 3060 98FB78~1.EXE 1780 svchost.com 1008 98FB78~1.EXE 2888 svchost.com 892 98FB78~1.EXE 1592 svchost.com 1704 98FB78~1.EXE 1676 svchost.com 2488 98FB78~1.EXE 1564 svchost.com 2944 98FB78~1.EXE 336 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 2740 svchost.com 2740 svchost.com 2688 svchost.com 2688 svchost.com 3024 svchost.com 3024 svchost.com 2812 svchost.com 2812 svchost.com 1432 svchost.com 1432 svchost.com 2040 svchost.com 2040 svchost.com 2732 svchost.com 2732 svchost.com 2508 svchost.com 2508 svchost.com 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 3060 svchost.com 3060 svchost.com 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 344 svchost.com 344 svchost.com 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 524 svchost.com 524 svchost.com 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 1652 svchost.com 1652 svchost.com 1428 svchost.com 1428 svchost.com 2736 svchost.com 2736 svchost.com 2600 svchost.com 2600 svchost.com 2232 svchost.com 2232 svchost.com 2612 svchost.com 2612 svchost.com 2412 svchost.com 2412 svchost.com 1928 svchost.com 1928 svchost.com 2328 svchost.com 2328 svchost.com 264 svchost.com 264 svchost.com 2384 svchost.com 2384 svchost.com 2312 svchost.com 2312 svchost.com 1680 svchost.com 1680 svchost.com 2256 svchost.com 2256 svchost.com 828 svchost.com 828 svchost.com 1780 svchost.com 1780 svchost.com 2888 svchost.com 2888 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 98FB78~1.EXE File opened for modification C:\Windows\svchost.com 98FB78~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FB78~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2788 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 31 PID 2652 wrote to memory of 2788 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 31 PID 2652 wrote to memory of 2788 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 31 PID 2652 wrote to memory of 2788 2652 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 31 PID 2788 wrote to memory of 2740 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 32 PID 2788 wrote to memory of 2740 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 32 PID 2788 wrote to memory of 2740 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 32 PID 2788 wrote to memory of 2740 2788 98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe 32 PID 2740 wrote to memory of 2624 2740 svchost.com 33 PID 2740 wrote to memory of 2624 2740 svchost.com 33 PID 2740 wrote to memory of 2624 2740 svchost.com 33 PID 2740 wrote to memory of 2624 2740 svchost.com 33 PID 2624 wrote to memory of 2688 2624 98FB78~1.EXE 34 PID 2624 wrote to memory of 2688 2624 98FB78~1.EXE 34 PID 2624 wrote to memory of 2688 2624 98FB78~1.EXE 34 PID 2624 wrote to memory of 2688 2624 98FB78~1.EXE 34 PID 2688 wrote to memory of 2544 2688 svchost.com 35 PID 2688 wrote to memory of 2544 2688 svchost.com 35 PID 2688 wrote to memory of 2544 2688 svchost.com 35 PID 2688 wrote to memory of 2544 2688 svchost.com 35 PID 2544 wrote to memory of 3024 2544 98FB78~1.EXE 36 PID 2544 wrote to memory of 3024 2544 98FB78~1.EXE 36 PID 2544 wrote to memory of 3024 2544 98FB78~1.EXE 36 PID 2544 wrote to memory of 3024 2544 98FB78~1.EXE 36 PID 3024 wrote to memory of 564 3024 svchost.com 37 PID 3024 wrote to memory of 564 3024 svchost.com 37 PID 3024 wrote to memory of 564 3024 svchost.com 37 PID 3024 wrote to memory of 564 3024 svchost.com 37 PID 564 wrote to memory of 2812 564 98FB78~1.EXE 38 PID 564 wrote to memory of 2812 564 98FB78~1.EXE 38 PID 564 wrote to memory of 2812 564 98FB78~1.EXE 38 PID 564 wrote to memory of 2812 564 98FB78~1.EXE 38 PID 2812 wrote to memory of 2884 2812 svchost.com 39 PID 2812 wrote to memory of 2884 2812 svchost.com 39 PID 2812 wrote to memory of 2884 2812 svchost.com 39 PID 2812 wrote to memory of 2884 2812 svchost.com 39 PID 2884 wrote to memory of 1432 2884 98FB78~1.EXE 40 PID 2884 wrote to memory of 1432 2884 98FB78~1.EXE 40 PID 2884 wrote to memory of 1432 2884 98FB78~1.EXE 40 PID 2884 wrote to memory of 1432 2884 98FB78~1.EXE 40 PID 1432 wrote to memory of 1536 1432 svchost.com 41 PID 1432 wrote to memory of 1536 1432 svchost.com 41 PID 1432 wrote to memory of 1536 1432 svchost.com 41 PID 1432 wrote to memory of 1536 1432 svchost.com 41 PID 1536 wrote to memory of 2040 1536 98FB78~1.EXE 42 PID 1536 wrote to memory of 2040 1536 98FB78~1.EXE 42 PID 1536 wrote to memory of 2040 1536 98FB78~1.EXE 42 PID 1536 wrote to memory of 2040 1536 98FB78~1.EXE 42 PID 2040 wrote to memory of 1176 2040 svchost.com 114 PID 2040 wrote to memory of 1176 2040 svchost.com 114 PID 2040 wrote to memory of 1176 2040 svchost.com 114 PID 2040 wrote to memory of 1176 2040 svchost.com 114 PID 1176 wrote to memory of 2732 1176 98FB78~1.EXE 119 PID 1176 wrote to memory of 2732 1176 98FB78~1.EXE 119 PID 1176 wrote to memory of 2732 1176 98FB78~1.EXE 119 PID 1176 wrote to memory of 2732 1176 98FB78~1.EXE 119 PID 2732 wrote to memory of 988 2732 svchost.com 45 PID 2732 wrote to memory of 988 2732 svchost.com 45 PID 2732 wrote to memory of 988 2732 svchost.com 45 PID 2732 wrote to memory of 988 2732 svchost.com 45 PID 988 wrote to memory of 2508 988 98FB78~1.EXE 46 PID 988 wrote to memory of 2508 988 98FB78~1.EXE 46 PID 988 wrote to memory of 2508 988 98FB78~1.EXE 46 PID 988 wrote to memory of 2508 988 98FB78~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe"C:\Users\Admin\AppData\Local\Temp\98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\98fb7808bd50d136c90e6f4e0ecaa76244f2c9958f84fba64ff3d801133fa43c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE18⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2136 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE22⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE24⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE26⤵
- Executes dropped EXE
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE28⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE32⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE34⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE38⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE40⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE42⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE48⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE50⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE52⤵
- Executes dropped EXE
PID:1016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE54⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE56⤵
- Executes dropped EXE
PID:1008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE58⤵
- Executes dropped EXE
PID:892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"59⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE60⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"61⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE62⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE66⤵PID:1628
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"67⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE68⤵PID:2680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"69⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE70⤵PID:2792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE72⤵
- Drops file in Windows directory
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"73⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE74⤵
- Drops file in Windows directory
PID:2068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE76⤵
- Drops file in Windows directory
PID:2232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"77⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE78⤵PID:1616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE80⤵PID:2704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"81⤵
- Drops file in Windows directory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE82⤵PID:2028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"83⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE84⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"85⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE86⤵PID:2584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"87⤵
- Drops file in Windows directory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE88⤵PID:1528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"89⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE90⤵PID:2732
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"91⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE92⤵PID:1904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"93⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE94⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"95⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE96⤵PID:2228
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"97⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE98⤵PID:2136
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"99⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE100⤵PID:2240
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"101⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE102⤵PID:1692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"103⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE104⤵
- Drops file in Windows directory
PID:2268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"105⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE106⤵
- Drops file in Windows directory
PID:1840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"107⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE108⤵PID:1524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE110⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"111⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE112⤵PID:2900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"113⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"115⤵
- Drops file in Windows directory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE116⤵PID:2576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"117⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE118⤵
- Drops file in Windows directory
PID:2556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"119⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE120⤵
- Drops file in Windows directory
PID:2956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\98FB78~1.EXE"121⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-