Analysis
-
max time kernel
32s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 03:55
Behavioral task
behavioral1
Sample
9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe
-
Size
219KB
-
MD5
c32404882bf22d793acd7f9596c7be80
-
SHA1
bea147e215f67276a1ea5ca1c5806d0639a590e9
-
SHA256
9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edf
-
SHA512
c6e82baa0cb5bf114b510d8ec6ecd8edc5150535189a43016350635a4ef3e91fe66b939604ce5f02796706879b690b2904c21e80e395ff6ad42ecde6c1ba028b
-
SSDEEP
3072:sr85CDicYPym++7obFQ/eWV7XmY2BN+v6zAmzG7Ur85C:k9GAm++05QxV7XI+vM67M9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000019329-2.dat family_neshta behavioral1/files/0x0007000000019345-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x001700000000f7f7-18.dat family_neshta behavioral1/files/0x001400000001033a-17.dat family_neshta behavioral1/memory/1408-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2492-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1104-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d6-98.dat family_neshta behavioral1/memory/1624-105-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e9-120.dat family_neshta behavioral1/files/0x000100000000f7cd-119.dat family_neshta behavioral1/files/0x000100000000f779-118.dat family_neshta behavioral1/files/0x000100000000f7db-117.dat family_neshta behavioral1/memory/1248-104-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f830-130.dat family_neshta behavioral1/files/0x000100000000f875-132.dat family_neshta behavioral1/files/0x000100000000f831-131.dat family_neshta behavioral1/memory/2196-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1868-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1704-158-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2272-171-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2156-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1556-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2556-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-259-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2524-258-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2172-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2764-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2020-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1744-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1592-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2516-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2520-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2352-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1448-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1876-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1836-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1868-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2972 svchost.com 1408 9CF635~1.EXE 2772 svchost.com 2740 9CF635~1.EXE 2492 svchost.com 2832 9CF635~1.EXE 2788 svchost.com 2656 9CF635~1.EXE 1180 svchost.com 1104 9CF635~1.EXE 1624 svchost.com 1248 9CF635~1.EXE 2196 svchost.com 1868 9CF635~1.EXE 1704 svchost.com 2964 9CF635~1.EXE 2156 svchost.com 2272 9CF635~1.EXE 2936 svchost.com 2432 9CF635~1.EXE 1960 svchost.com 1556 9CF635~1.EXE 1708 svchost.com 2556 9CF635~1.EXE 2532 svchost.com 1948 9CF635~1.EXE 2524 svchost.com 2192 9CF635~1.EXE 2172 svchost.com 2744 9CF635~1.EXE 2764 svchost.com 2872 9CF635~1.EXE 2620 svchost.com 2020 9CF635~1.EXE 2588 svchost.com 2608 9CF635~1.EXE 1656 svchost.com 2784 9CF635~1.EXE 2052 svchost.com 1744 9CF635~1.EXE 1592 svchost.com 2968 9CF635~1.EXE 2396 svchost.com 2516 9CF635~1.EXE 2352 svchost.com 2520 9CF635~1.EXE 1448 svchost.com 1876 9CF635~1.EXE 1836 svchost.com 1868 9CF635~1.EXE 532 svchost.com 1904 9CF635~1.EXE 2228 svchost.com 2916 9CF635~1.EXE 2480 svchost.com 2276 9CF635~1.EXE 3036 svchost.com 828 9CF635~1.EXE 920 svchost.com 324 9CF635~1.EXE 1784 svchost.com 1720 9CF635~1.EXE 1736 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2972 svchost.com 2972 svchost.com 2772 svchost.com 2772 svchost.com 2492 svchost.com 2492 svchost.com 2788 svchost.com 2788 svchost.com 1180 svchost.com 1180 svchost.com 1624 svchost.com 1624 svchost.com 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2196 svchost.com 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2196 svchost.com 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 1704 svchost.com 1704 svchost.com 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2156 svchost.com 2156 svchost.com 2936 svchost.com 2936 svchost.com 1960 svchost.com 1960 svchost.com 1708 svchost.com 1708 svchost.com 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2532 svchost.com 2532 svchost.com 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2524 svchost.com 2524 svchost.com 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 2172 svchost.com 2172 svchost.com 2764 svchost.com 2764 svchost.com 2620 svchost.com 2620 svchost.com 2588 svchost.com 2588 svchost.com 1656 svchost.com 1656 svchost.com 2052 svchost.com 2052 svchost.com 1592 svchost.com 1592 svchost.com 2396 svchost.com 2396 svchost.com 2352 svchost.com 2352 svchost.com 1448 svchost.com 1448 svchost.com 1836 svchost.com 1836 svchost.com 532 svchost.com 532 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com 9CF635~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys 9CF635~1.EXE File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF635~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2024 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 30 PID 2568 wrote to memory of 2024 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 30 PID 2568 wrote to memory of 2024 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 30 PID 2568 wrote to memory of 2024 2568 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 30 PID 2024 wrote to memory of 2972 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 31 PID 2024 wrote to memory of 2972 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 31 PID 2024 wrote to memory of 2972 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 31 PID 2024 wrote to memory of 2972 2024 9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe 31 PID 2972 wrote to memory of 1408 2972 svchost.com 32 PID 2972 wrote to memory of 1408 2972 svchost.com 32 PID 2972 wrote to memory of 1408 2972 svchost.com 32 PID 2972 wrote to memory of 1408 2972 svchost.com 32 PID 1408 wrote to memory of 2772 1408 9CF635~1.EXE 33 PID 1408 wrote to memory of 2772 1408 9CF635~1.EXE 33 PID 1408 wrote to memory of 2772 1408 9CF635~1.EXE 33 PID 1408 wrote to memory of 2772 1408 9CF635~1.EXE 33 PID 2772 wrote to memory of 2740 2772 svchost.com 34 PID 2772 wrote to memory of 2740 2772 svchost.com 34 PID 2772 wrote to memory of 2740 2772 svchost.com 34 PID 2772 wrote to memory of 2740 2772 svchost.com 34 PID 2740 wrote to memory of 2492 2740 9CF635~1.EXE 35 PID 2740 wrote to memory of 2492 2740 9CF635~1.EXE 35 PID 2740 wrote to memory of 2492 2740 9CF635~1.EXE 35 PID 2740 wrote to memory of 2492 2740 9CF635~1.EXE 35 PID 2492 wrote to memory of 2832 2492 svchost.com 36 PID 2492 wrote to memory of 2832 2492 svchost.com 36 PID 2492 wrote to memory of 2832 2492 svchost.com 36 PID 2492 wrote to memory of 2832 2492 svchost.com 36 PID 2832 wrote to memory of 2788 2832 9CF635~1.EXE 37 PID 2832 wrote to memory of 2788 2832 9CF635~1.EXE 37 PID 2832 wrote to memory of 2788 2832 9CF635~1.EXE 37 PID 2832 wrote to memory of 2788 2832 9CF635~1.EXE 37 PID 2788 wrote to memory of 2656 2788 svchost.com 38 PID 2788 wrote to memory of 2656 2788 svchost.com 38 PID 2788 wrote to memory of 2656 2788 svchost.com 38 PID 2788 wrote to memory of 2656 2788 svchost.com 38 PID 2656 wrote to memory of 1180 2656 9CF635~1.EXE 39 PID 2656 wrote to memory of 1180 2656 9CF635~1.EXE 39 PID 2656 wrote to memory of 1180 2656 9CF635~1.EXE 39 PID 2656 wrote to memory of 1180 2656 9CF635~1.EXE 39 PID 1180 wrote to memory of 1104 1180 svchost.com 40 PID 1180 wrote to memory of 1104 1180 svchost.com 40 PID 1180 wrote to memory of 1104 1180 svchost.com 40 PID 1180 wrote to memory of 1104 1180 svchost.com 40 PID 1104 wrote to memory of 1624 1104 9CF635~1.EXE 41 PID 1104 wrote to memory of 1624 1104 9CF635~1.EXE 41 PID 1104 wrote to memory of 1624 1104 9CF635~1.EXE 41 PID 1104 wrote to memory of 1624 1104 9CF635~1.EXE 41 PID 1624 wrote to memory of 1248 1624 svchost.com 42 PID 1624 wrote to memory of 1248 1624 svchost.com 42 PID 1624 wrote to memory of 1248 1624 svchost.com 42 PID 1624 wrote to memory of 1248 1624 svchost.com 42 PID 1248 wrote to memory of 2196 1248 9CF635~1.EXE 43 PID 1248 wrote to memory of 2196 1248 9CF635~1.EXE 43 PID 1248 wrote to memory of 2196 1248 9CF635~1.EXE 43 PID 1248 wrote to memory of 2196 1248 9CF635~1.EXE 43 PID 2196 wrote to memory of 1868 2196 svchost.com 80 PID 2196 wrote to memory of 1868 2196 svchost.com 80 PID 2196 wrote to memory of 1868 2196 svchost.com 80 PID 2196 wrote to memory of 1868 2196 svchost.com 80 PID 1868 wrote to memory of 1704 1868 9CF635~1.EXE 126 PID 1868 wrote to memory of 1704 1868 9CF635~1.EXE 126 PID 1868 wrote to memory of 1704 1868 9CF635~1.EXE 126 PID 1868 wrote to memory of 1704 1868 9CF635~1.EXE 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe"C:\Users\Admin\AppData\Local\Temp\9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9cf6354caf3d1d8e819743b6c6a9769861f083f01dfa36bd88b175395f5c2edfN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE18⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE20⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE22⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE24⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE26⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE28⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE32⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE34⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE36⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE38⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE40⤵
- Executes dropped EXE
PID:2784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE42⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE44⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE46⤵
- Executes dropped EXE
PID:2516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE48⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE50⤵
- Executes dropped EXE
PID:1876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE52⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE54⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"55⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE56⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"57⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE58⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"59⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE60⤵
- Executes dropped EXE
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"61⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE62⤵
- Executes dropped EXE
PID:324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"63⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE64⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"65⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE66⤵PID:992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"67⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE68⤵PID:896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"69⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE70⤵PID:2360
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"71⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE72⤵PID:1536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"73⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE74⤵PID:2692
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"75⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE76⤵PID:2868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"77⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE78⤵
- Drops file in Windows directory
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"79⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE80⤵
- Drops file in Windows directory
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"81⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE82⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"83⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE84⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"85⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE86⤵PID:2376
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"87⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE88⤵PID:1900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"89⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE90⤵PID:2136
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE92⤵PID:1452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"93⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"95⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE96⤵PID:2980
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"97⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE98⤵
- Drops file in Windows directory
PID:1704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"99⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE100⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"101⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE102⤵
- Drops file in Windows directory
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"103⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE104⤵PID:1204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"105⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE106⤵PID:1792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"107⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"109⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE110⤵
- Drops file in Windows directory
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"111⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE112⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE114⤵PID:2536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"115⤵
- Drops file in Windows directory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE116⤵PID:2176
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"117⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE118⤵PID:2016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE120⤵PID:2704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9CF635~1.EXE"121⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-