Malware Analysis Report

2025-01-22 14:59

Sample ID 241212-bg88mazjfj
Target 2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1
SHA256 2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1
Tags
infected orcus discovery persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1

Threat Level: Known bad

The file 2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1 was found to be: Known bad.

Malicious Activity Summary

infected orcus discovery persistence rat spyware stealer

Orcurs Rat Executable

Orcus

Orcus family

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-12 01:08

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-12 01:08

Reported

2024-12-12 08:59

Platform

win7-20241023-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsInput.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsInput.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\registry = "\"C:\\Program Files\\WindowsFirewall\\runtime.exe\"" C:\Program Files\WindowsFirewall\runtime.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File opened for modification C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File created C:\Program Files\WindowsFirewall\runtime.exe.config C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900014dc734cdb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000045ca678aeed2ff0dd61a2e1ac29683c31516af78f6632b3cb1d7e1eeedc080e6000000000e80000000020000200000007de23a2c5af3cd6785016c58c8216384732d4508250453229d18075561a8448420000000d432e41eba45e1a0895670c9d373cbe8095fa499d5572a8967c6323fd86ebed440000000a24cebf86ae0be76332db04bbe1012fd818bbf9f845ec9f5316ac95d140d93930049a5fb05e9ac2ff16f5be95a0d558a7d8faa5d327e9d462ea1e25c5fcb4b38 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000414690c69ed163befb11eec7739b1949bd4ff6acfb1fc213be14a23ac2652d84000000000e80000000020000200000001cf9b1d3c53bfacb4141fd344545e3a02044ae0d96071a43df41ecfa1c3c48cd900000004a774853739f591ad2a89b6350c0ba60ef0fc07c6aafa2457c81bd36e3e433cd03fe07f259e563e9402eb03bbe8262388004096d2e9a12e265f3fba240d3667b89fb1ec060cc316c44be35718ff5083a129a789a5edfc033da8f013d282e229893e78605273e870b24908d915f6e8691812b8c0791b4ab1baf27ed316e81f75bcf70785a0af2163c99a5c9fbea690ee8400000002b76ba4d8ab6a9d59dead4be2afa4202c5f78eb4dca01c9312295db740e2b7d39786bceb9821f74cf7f4a304e70773d6c5033d2da37f3642a6bd1f8694db0d58 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440155734" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14657371-B867-11EF-BE68-6A5AD4CEBEC5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\WindowsFirewall\runtime.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2592 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2592 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2592 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2592 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2592 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2780 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2780 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2780 wrote to memory of 2928 N/A C:\Windows\system32\taskeng.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 2916 wrote to memory of 2836 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2836 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2836 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2836 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2836 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2836 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2836 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2836 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2956 wrote to memory of 2968 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2968 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2968 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2968 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1952 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1952 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1952 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1952 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2956 wrote to memory of 1372 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1372 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1372 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 1372 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1716 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1716 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1716 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1716 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2956 wrote to memory of 2244 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2244 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2244 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2244 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 1840 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1840 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1840 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 1840 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2956 wrote to memory of 872 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 872 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 872 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 872 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 2340 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2340 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2340 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2340 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2676 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2676 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2676 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2676 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2956 wrote to memory of 2264 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2264 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2264 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2956 wrote to memory of 2264 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2916 wrote to memory of 2292 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2292 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2292 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2292 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2372 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2372 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 2916 wrote to memory of 2372 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe

"C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Program Files\WindowsFirewall\runtime.exe

"C:\Program Files\WindowsFirewall\runtime.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {CF630C05-FAFB-4C28-A1C3-687ABE2D7B8E} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]

C:\Program Files\WindowsFirewall\runtime.exe

"C:\Program Files\WindowsFirewall\runtime.exe"

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=Windows_Services.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275471 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:537625 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:1061901 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:865314 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:4142104 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:996415 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:799834 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:1258541 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:1848397 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:2241602 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:3748961 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:537741 /prefetch:2

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 2916 /protectFile

Network

Country Destination Domain Proto
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 198.98.58.93:1488 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp

Files

memory/2592-0-0x000007FEF53F3000-0x000007FEF53F4000-memory.dmp

memory/2592-1-0x0000000000A00000-0x0000000000CFC000-memory.dmp

memory/2592-2-0x0000000000240000-0x000000000029C000-memory.dmp

memory/2592-3-0x00000000002B0000-0x00000000002BE000-memory.dmp

memory/2592-4-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/2592-5-0x0000000000300000-0x0000000000312000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 a80be96476032d2eaa901d180fe9fb73
SHA1 f378d0bc5fefb9ea0b5006f020091ffcbcd7acec
SHA256 d6075c1ed6f285f5de01ce0cc6a817b59054da8b19f20bc7081cfe7fb2b1af42
SHA512 210c0c4c845b416a601015fba5ccd2a3e8a4b81d3b4c5e0491b07bd0dcad938d9b118728bb1abc21eb73c5f9263a3c08e1822ece91002a2d1f0983857f0192ea

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/1976-13-0x0000000000230000-0x000000000023C000-memory.dmp

memory/1976-14-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/1976-15-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/1976-18-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/2364-20-0x0000000000380000-0x000000000038C000-memory.dmp

C:\Program Files\WindowsFirewall\runtime.exe

MD5 83cc0cba6f510ad5eb3142f10019e36b
SHA1 e0f4545ef4c967a8a22a1b4790a88b6fe679446b
SHA256 2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1
SHA512 7a87f2dbb054495a1f91b8bd7c1dd232314d3eca1b3b95798af0eb7518a99bd6f585124e9ac9f1f06c144ed9ce6b9efe5bf674141b83ac177484a786948a81fd

memory/2916-30-0x00000000000A0000-0x000000000039C000-memory.dmp

memory/2592-29-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp

memory/2916-31-0x00000000008E0000-0x0000000000938000-memory.dmp

memory/2916-32-0x0000000000990000-0x00000000009A8000-memory.dmp

memory/2916-33-0x00000000009B0000-0x00000000009C0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows_Services.exe.config

MD5 740dde6369b1c855ea2f8e171fa888c8
SHA1 db3f1c7e5e4c087cf9eb02376fd750f1879f28f8
SHA256 e03c480b46464159387618445ca9fd9870b53e092e2278837f2d5a54daf06cae
SHA512 114607dcee4439e5e5c97ca986a65c8114a0e3f3c56f494ef6eaac9cb0f9ebf29b828aabc3100e4be197c94d54a7c26513942c56806bfb3bb0d3594ffef7458c

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

MD5 8ace06702ec59d170ca2b31f95812e0f
SHA1 de36712adf9b67d0b4c99d12eb59361adfc5473f
SHA256 f74d37fae8e3fb82eff8d6acf755687d9fb38403c38512ad794f16d5b471ce45
SHA512 5d4dc9ad439f66a17f286800559f1ad13f798cf633eaa7319f41691f2d11a519cccab568e0dd2cadebe4258f51d760fab9ca67e7ecb6c97ff496c9308de6cec5

C:\Users\Admin\AppData\Local\Temp\CabDC0F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarDC40.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d3e592338fcb158fcfe65b335e3a158
SHA1 f1d89c99be57edd819388619e68d2f0bc11c42e7
SHA256 82d50cd4ac43103e692076a3e76ba6e93fc8049d1e23d2aca12459d878f7c845
SHA512 bd0fa6d4de4a08c131e213091e324e60c18d62c40d49baeca88e76bca965ec3aa2916436e96929f49f44e51c9084ab1922086f3ca1fa5bb4a63e4dba1de31be9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 942907cfea3463de5e6d978e8b9877da
SHA1 4b64ec64d2333d2578a751728321439461017956
SHA256 3b2b9c6d7dbd3d4bc46e88c08b0c753ea12b46c3d5bf2f6c69cbf10cfa51d23b
SHA512 c946c34770519ed674cc186ff896381c027847aa70c860ea4c145a0d2ec73c64deeee9a858ef87110a7df2e48f16a40b1f27ca715ad8694120945a0644ec5107

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c1953ce48667c3abaed45112a05dc3c
SHA1 1a0bcd15b88b89db3fedc01b5d3aa374dee92697
SHA256 f08ec15e0287b3f9ab9ccc202765c04a7401c05e12a77fd3e636b0c7f7906a51
SHA512 fe619281e02e632a83d337372ccef920b9a9671d66e85760b39458b6d803bcba2a6271e6c5d95e90d91353cdd40b29e965bd58ff295db774314f650ad41045cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5c9968a4b58ad1fef4b832efc6f0844
SHA1 97c4663c3f9f157b3466ecc47d8d8edbdf2e6492
SHA256 ba90ebe0867fcc686b23ce571fdabc5f624cbfb4fdf061409b7357c2494a17ef
SHA512 cd1ad39183ce9f908e188475c4f817d1fa7ce86767c747c41d4918b5a2f17ce8a3692023e28795cc4122bc560e3e898215aabacb96102d3696a2466de1f6d464

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a064d780bc47d9271eba8797a9a52561
SHA1 a8eb608381b44b75e1b4ea689277a11345348005
SHA256 bbff4ab2250db647fb0cecef2ba3522a58849d4eb82efd1ae3f55d51111de928
SHA512 12491f981e552ff8dadac08f7c6dda8fd39cccf8c22aea32202f6d6c45e245604bc88b36a2a66f8daff1b1283879e184ef92ee5dfc66aadb1469574945e4e74b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 365f2cb37ab3625cae21bb730fd2b984
SHA1 65a6fe465aaa5b936f2bb317748b3e8a5546ce47
SHA256 4bc287eeaf6aaf64235776cc0e1bb2c7476f9b6255ac79ca7fdb8e5ad584b566
SHA512 06995273e1c774a806fe86bd243712a56ae3e1f9cea34a242ccb580677895d972b8d38c1e50e274eaf72bbb95e6fc03e5b0429a9b89b42dbfd40c0ae2e5382bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9274e00db4e185d13c5f64d542f0fcdf
SHA1 3b05c227cd9a83c0e49bcafc6648e9e08feb1278
SHA256 65046778aaac39bde624bdac514dc49c449d241e0813b2f953ed30ce6ce078d9
SHA512 20bb0858a924a35f9f8a523391f16866a507a8fa1438bd9750a6c7c7c965befa5361524dacf77bb7b236e460e174f52402336151beee712a00f1ae47e0b77f10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 413cc9681975ebeb71d8835eec7fdd07
SHA1 3ef1c5a26ef6eb6a58dfd5b73c438d2ea1a24ad7
SHA256 a0ffad470ba4336a7eb61db85aa4c991781d4fc024b3a2cc44e4c610e7492b42
SHA512 bad8e51ecf06a3e45c313861187da29c5412719b93d68786a0293b2528c35a5b0089e2c40256f15f5f9a728ac584dada67df351c5e4bcaeae3ea574366ab9e6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aee25b606aa50d10d94703a5023d87be
SHA1 fd063db7ce098ddc630d5c4ae8a7ff86380ba5c7
SHA256 1d31807e4ae80594ea25cce410a3d227f2a49ee3369228b1e9719a753cf0410b
SHA512 05b3b12b282b6be3ba397cc4b220d30956459916eb24f68150207fba4a5f7390a9cd0fc125cda76fc92956537e9750b067a71e8b376168bc62d19e70b36bd1ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da8dae51ac8f768653bbbbff5425e3ca
SHA1 6f9dda38846e44eaa107508b089faf980a61d239
SHA256 fa8dacd23c3a7e13f160b1ee6eceddc7e25c0ab3e67a99c55a6cc2be0d152b88
SHA512 1c6758e9b9325628238a723c6fa95ecd9517be28f80e87a4dd27dd253d2cdfa0809f2aedf2b5741c0e814de2c95d91d67967620a8471b825a939a65f4a24776b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3647bab01c1626eaf8153a2accc2789e
SHA1 7c2c821deca12f4a679bf7c25ae23a7379f8b427
SHA256 7e17c470a01deab60a7fd4f9cc9443b7876bb2d8ef75c5ca4be4cfa2ca2a40c5
SHA512 d2d8c2efdfaff68651d7ae8de19a0c5fa3b46f6563ffaf9defe1c8fecad8d8e734340a11f87da0da40a6b492bb1e183c5c5de1e04c0b49e9c2383bccf13771f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ca1e100f821704ef4f3c5302e315fef
SHA1 b169a5dda770430fec757fa3e53cb8fb55e585e9
SHA256 56f1d834f194fcdd9662dce0ba44d8d36979693ac07688a0dce66ed04937f46e
SHA512 e3a6139f69be5911a0a8c1d3d359315e4df1d63ffb55dff16bf88b2dc1c9eccf8f8099f1cc84be81f85b4f3ac2125718f1f43c8160611789e877732f03424320

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf492c2eac424871a313df1d00d6b27b
SHA1 ec6b21e1af1aefe77db7f73e38c6012457947551
SHA256 9ef1b19c161793c114e83b102633d51f61a733800c568f37f29a801e22b9f939
SHA512 f7e6add139add3c58342e23e61276424e3e5148336cd4fc5a2c1798e9f058c3a7e5d6421d6b419876ae9c046e691bb40050fc1cfea9513411246c55e086333b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3fec5c915b6f1d316089aa974ac2a42
SHA1 83ec46a13aa4b322ae7488da1b103e1d0597b0c4
SHA256 32647790488e8ee31914de10d68c152f42e2483df419e14f04ba1c4815751495
SHA512 593ecf0d4f945ac90dc88198fb6636cbbc2b5c79b24bba4519a4f503de3856c68da21bb8e1e15f7b6b3e9e683184b0740468fcce732ef3cf2f2d710046bf44d6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\invalidcert[1]

MD5 a5d6ba8403d720f2085365c16cebebef
SHA1 487dcb1af9d7be778032159f5c0bc0d25a1bf683
SHA256 59e53005e12d5c200ad84aeb73b4745875973877bd7a2f5f80512fe507de02b7
SHA512 6341b8af2f9695bb64bbf86e3b7bfb158471aef0c1b45e8b78f6e4b28d5cb03e7b25f4f0823b503d7e9f386d33a7435e5133117778291a3c543cafa677cdc82d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BQ20K5D\ErrorPageTemplate[1]

MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
SHA512 62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BQ20K5D\invalidcert[1]

MD5 8ce0833cca8957bda3ad7e4fe051e1dc
SHA1 e5b9df3b327f52a9ed2d3821851e9fdd05a4b558
SHA256 f18e9671426708c65f999ca0fd11492e699cb13edc84a7d863fa9f83eb2178c3
SHA512 283b4c6b1035b070b98e7676054c8d52608a1c9682dfe138c569adfecf84b6c5b04fe1630eb13041ad43a231f83bf38680198acd8d5a76a47ec77829282a99fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\red_shield_48[1]

MD5 7c588d6bb88d85c7040c6ffef8d753ec
SHA1 7fdd217323d2dcc4a25b024eafd09ae34da3bfef
SHA256 5e2cd0990d6d3b0b2345c75b890493b12763227a8104de59c5142369a826e3e0
SHA512 0a3add1ff681d5190075c59caffde98245592b9a0f85828ab751e59fdf24403a4ef87214366d158e6b8a4c59c5bdaf563535ff5f097f86923620ea19a9b0dc4d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\green_shield[1]

MD5 c6452b941907e0f0865ca7cf9e59b97d
SHA1 f9a2c03d1be04b53f2301d3d984d73bf27985081
SHA256 1ba122f4b39a33339fa9935bf656bb0b4b45cdded78afb16aafd73717d647439
SHA512 beb58c06c2c1016a7c7c8289d967eb7ffe5840417d9205a37c6d97bd51b153f4a053e661ad4145f23f56ce0aebda101932b8ed64b1cd4178d127c9e2a20a1f58

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\red_shield[1]

MD5 006def2acbd0d2487dffc287b27654d6
SHA1 c95647a113afc5241bdb313f911bf338b9aeffdc
SHA256 4bd9f96d6971c7d37d03d7dea4af922420bb7c6dd46446f05b8e917c33cf9e4e
SHA512 9dabf92ce2846d8d86e20550c749efbc4a1af23c2319e6ce65a00dc8cbc75ac95a2021020cab1536c3617043a8739b0495302d0ba562f48f4d3c25104b059a04

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BQ20K5D\down[1]

MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
SHA512 d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\background_gradient_red[1]

MD5 337038e78cf3c521402fc7352bdd5ea6
SHA1 017eaf48983c31ae36b5de5de4db36bf953b3136
SHA256 fbc23311fb5eb53c73a7ca6bfc93e8fa3530b07100a128b4905f8fb7cb145b61
SHA512 0928d382338f467d0374cce3ff3c392833fe13ac595943e7c5f2aee4ddb3af3447531916dd5ddc716dd17aef14493754ed4c2a1ab7fe6e13386301e36ee98a7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48fb5b11bda933002782bdb56770e710
SHA1 4f3061acde4d9f50913d81cec4d25e3bfeec7b5d
SHA256 b50aa7461998b93c29fa65100ba89a21e7cc6bda7eb21591e105b28ddf3e3c00
SHA512 54bfce260fbf65f560c3f02f6041d03e644bc9aceaaafc6c79565a2b494dc7a39844850db5c0c0a930bf564dc3f763f977aa63fb070a460f0cb51e6c169930bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9153cb0707736145633c546178e55ae
SHA1 9e4519442795854fca46d6cda6cac13b154f7a7c
SHA256 dc24b71cbe255b1025dcf46a0deee132dfddf1dc99b83d5867bb84b94cb3f4e8
SHA512 d8e2b69c0987c03c8a729f93e52035c5f6dd47e4a0d74bcc548835352c2586b0dda103b5264b6fce705bf1bfc85ba8da13cc634028156c2816014a76e43fef0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eaac234773b955f3dd44a2042fd74c7a
SHA1 e9280ef45187868f5573c1ed5763209bb56d51b9
SHA256 0bd84a80530d6d7b223fe1a5b035e80dda647fd40600bb1fe1b9e18b341d0f35
SHA512 f882595ae8d1aa685a17a06d6dd926e463f57484a2c79d8898fb82fe9d5e6e085f72f258c7817b4505c29c69001ec61cfcf1864038227e78d7df917ab40145b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 acafe24e9b2bb9e9c03c301f91d0facb
SHA1 5e1989b24e0046bea3fbbe468969f15b88996bd9
SHA256 3db7c00cd4d00fff85f44c7c04534991cbba9057c7de3a500c772ed49191373f
SHA512 ffc4e6ac998ce3deec8a3a548606b2b82add68d39559748709d9f99f277005cad1145a614426cab647be9918366a2f4580a0d1bf45b8f5c5492f6cd014f91708

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d199ed1fba7a28abee0cedc63f9ff63
SHA1 41f536ec56b5585cbeb67f70689cfa40e51ccd4d
SHA256 f2e48586ea1860759573b63e8c0bb48df113adecb71a20cefb303576900123b7
SHA512 cacec62bb1ec2f6768b6d20aedbb93affcca3928664a81bd40f8045e750593ed9c5a520bdc58999966eff68a775253968507c889bcca882590f0b98721199048

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e19528d1a17f2f39c3128e95e63bfc05
SHA1 5f5d1e441c173c347766a529675fa320b48fae74
SHA256 f396399d73e51b457829773758cbd79180174bd4882c6f748b16ad914d57f855
SHA512 704f0bb6488677e773bdabc9923e5495dd59d755a2fecc5070e06a51df6fd9d8c43aaa3db982dce1011225eb31d747dbd16867f6e8979ec3e1806e2e35aa3dbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0af3b1ca3c57d2bb654c507f7b1a5366
SHA1 14e4dde21a3bbea784d22495e20faca97f07ebe2
SHA256 4182e58b19f80c65ddba3b9d4c55095d8bf18a92ecf4d05452336387ac6c0f77
SHA512 e115f2b62dc357cf35fde146a7477648956fa1cb1c1d87d133c3fa7ee9049ea2225436e26ba79dbf0619dcd399a5d6e45b3cf78dc361f6213fec990769c96cae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b4e95481db9f9d5366f7b9bdee50b5b
SHA1 06200ee6108245ed465a71a72d13cbee4cf9faa9
SHA256 d2091237c1e53635bb7cfffb2f8180ab322e69b41f2f126a67871c7cefc05475
SHA512 df0834dcd1660361b3978c2a1507f049cf05f91ca7c9a00c9b83dac3c1213c6b427c4c332434756e2b9820722a8cfe11bcc8e580034e54ce06a9c80432ac303c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7448969c8affbbc6ea463f0aa35e790
SHA1 80a7349a0b73f5c7fc8ca67b4d969b2e1ea4d752
SHA256 a1213050bd35dad44d19b824244e7257158568f413e228075fca1790bb839e36
SHA512 ef2ab82ae3299d1535f13ddec72ea3eddb309a332a8bbf2dbbeee71dedaf6d85f9e266aa936218bc870fe18938c89b5b8910cd397da4bb7a8ae51250a78839f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3c37fb8714c8d6c039063574bd21861
SHA1 252e2b4a2ac752ab8d89a5a4dfd9926aface098a
SHA256 d0603a522368278a9fe20444ec0475279b7d3d38583581bc1837fd180d7002f8
SHA512 1bb3764aa2599c610a1c83590923f6655f5e1fc56df417d4b88559fdcf85ae1478bbf2b6960f20faa0612c8b083ba9394c871878314fdf027460adf6e910222a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1127a204df2d914ac756eff81d35a90
SHA1 fa37e8a862b00cdaa3b70b0b4d1375ef9d1e86b4
SHA256 d1450a92e5efa9678112c106f4a4fb2904d5c5d02c26a26bdd407afe519532d3
SHA512 b0a09c6667a91870ea7d1565741a78613c39e5650dd10d2134472c571235007293fd4cf36cee2d1c9d06e51875af477abba549368ad7704be0711ce322da0b7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dac0ab5543425d2224f92ef6f94b21bb
SHA1 d18a3ad278ba3f0a3a97c9d85e03454dcb02bad7
SHA256 6e423e6c6a1a6ef5198dc52d3c62e12259bb82274e154d2384c05f17a9042301
SHA512 3934b280fb864072694d7a3dac8195ba0a2a7f9cade0fd013ed46f658c439f4197bd24433d14c2c1184e7add2585b924d312b489adc8dc5393956b460ecb9e70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07590c0ba09db58c861e9cc485312f29
SHA1 35e73c7b0b7eccd6521bab9d7410d33a609d6c7d
SHA256 a2df3edda0b523d91305fcad3c8b358f44ed6887bf1369e93bbe895e0137dc3e
SHA512 e20025ebf1f4320689c0cd1a2e6b251dae28129952dcfbea89b2b9472afeaaa87954f8a1abcdc2d29f7b910aabf1bdbe650ecd7759ddd58311e9a4924f169a2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 101f2648b9cc32e8c451f7d26a80e879
SHA1 0810c3c80ebaf0e205b0c0bab45ca6aad56bd351
SHA256 4cda29f70d3ca414f7224da97b9ab6bcc1720ba3a4c59e99895ef3f51af2a320
SHA512 7aeb438249285532e430f98762a21ef83eff48a3aed5f4fbffa913e5fcb6228eaa23282f627fe35959ca35faa9aefe5bdd591966611c000e5d37810ae0668a74

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b39cf904c504f6516178666b59be985
SHA1 0aa3f70389007d786524a316bfc4b52a6098af40
SHA256 0284a40245e4b757769fddd034f5155a6e58e65927feff79ba950474a15113e5
SHA512 4f5ae3137a701bb044ec930d761fb018e1b65faf07b6156eb7aff9d295a17c17c2579ff5f80e293ce5aaa6b57c051f68523d87227788c36f54b9637b6de36a2f

C:\Users\Admin\AppData\Local\Temp\~DF2171E8A9B5CE1869.TMP

MD5 70892d03f0c5bcef334b4be4613c0dec
SHA1 9550b14f09ee7f9bc2aee495dd24a07a34eab98c
SHA256 dcf74c25b3f2fef6bf2a9d1644b4ad425626dc2f761a44ec4762b411c5e03856
SHA512 71cff526390dcd1625dffd250b6eea7709922928b9a1721f40b551b81fe310742e03c67f70dae42e9ece03fd314405b39b7691b562aa0f27dacc67f16ab45736

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5481273e8e03d69c86aa7be0f0dbaf13
SHA1 ff5b70978e636fa817e168d2ee662f5939b6b6f3
SHA256 e42acd7a93937ec71bc0c943beb9ec748b9f73e48ce7770f85388c999fabbdc6
SHA512 91dc899c19a86d0cbb4a61f767c78d9cfc04f8ef1a02420c2fbaaece6a6ca7b55ca25c457fad70968df5952c0da782f8e5cc2a7195cfd558a08f744cf176193b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 27e747bd8f2255943be91e8413152e51
SHA1 7470b32e7410e91cde44e76ccbdf2463e9d732ed
SHA256 669cb9418d3ece47ff3eefa57705cff1af924057d41c588da0b999cf5cd00a61
SHA512 8e288a6bfe81735e8cd3e2a16307def14028d7fc1f94c98535041cc55dbcfe47c8500d7139c417cd96746375fa992ddba306158e43b5e4bd4f64d64a2bff034e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 653c83567d325674a600692be03c50e4
SHA1 e8e5126c5ae28548ee0a94edfbc776c9d5c6f8c0
SHA256 0b39fef95252a99192b80deb12f09b07379c6b3977fc3c2765267718412e0409
SHA512 93d6b484e729e9a8ec86b4b79d85240d8d4f0ee52df801425c1e1074fb0c09956e0677c79ae59693b6dbfc33f3313e3ca81704b2b79e8a612f696f95c25ab3c1

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-12 01:08

Reported

2024-12-12 07:50

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

169s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Program Files\WindowsFirewall\runtime.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\registry = "\"C:\\Program Files\\WindowsFirewall\\runtime.exe\"" C:\Program Files\WindowsFirewall\runtime.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsFirewall\runtime.exe.config C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File created C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A
File opened for modification C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
N/A N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\WindowsFirewall\runtime.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4568 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 4568 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 4568 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 4568 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe C:\Program Files\WindowsFirewall\runtime.exe
PID 4148 wrote to memory of 4000 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 4148 wrote to memory of 4000 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 4148 wrote to memory of 4000 N/A C:\Program Files\WindowsFirewall\runtime.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 4000 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 4000 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe
PID 4000 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\Windows_Services.exe C:\Users\Admin\AppData\Roaming\Windows_Services.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe

"C:\Users\Admin\AppData\Local\Temp\2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1.exe"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Program Files\WindowsFirewall\runtime.exe

"C:\Program Files\WindowsFirewall\runtime.exe"

C:\Program Files\WindowsFirewall\runtime.exe

"C:\Program Files\WindowsFirewall\runtime.exe"

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /launchSelfAndExit "C:\Program Files\WindowsFirewall\runtime.exe" 4148 /protectFile

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

"C:\Users\Admin\AppData\Roaming\Windows_Services.exe" /watchProcess "C:\Program Files\WindowsFirewall\runtime.exe" 4148 "/protectFile"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 198.98.58.93:1488 tcp
US 8.8.8.8:53 93.58.98.198.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 198.98.58.93:1488 tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 198.98.58.93:1488 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp
US 198.98.58.93:1488 tcp

Files

memory/4568-1-0x0000019A8DD10000-0x0000019A8E00C000-memory.dmp

memory/4568-0-0x00007FFEAEFA3000-0x00007FFEAEFA5000-memory.dmp

memory/4568-3-0x0000019A8E3A0000-0x0000019A8E3AE000-memory.dmp

memory/4568-2-0x0000019A8E460000-0x0000019A8E4BC000-memory.dmp

memory/4568-4-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

memory/4568-5-0x0000019A8E4D0000-0x0000019A8E4E2000-memory.dmp

C:\Windows\SysWOW64\WindowsInput.exe

MD5 a80be96476032d2eaa901d180fe9fb73
SHA1 f378d0bc5fefb9ea0b5006f020091ffcbcd7acec
SHA256 d6075c1ed6f285f5de01ce0cc6a817b59054da8b19f20bc7081cfe7fb2b1af42
SHA512 210c0c4c845b416a601015fba5ccd2a3e8a4b81d3b4c5e0491b07bd0dcad938d9b118728bb1abc21eb73c5f9263a3c08e1822ece91002a2d1f0983857f0192ea

C:\Windows\SysWOW64\WindowsInput.exe.config

MD5 a2b76cea3a59fa9af5ea21ff68139c98
SHA1 35d76475e6a54c168f536e30206578babff58274
SHA256 f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512 b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

memory/4844-19-0x000001E7055C0000-0x000001E7055CC000-memory.dmp

memory/4844-20-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

memory/4844-21-0x000001E707270000-0x000001E707282000-memory.dmp

memory/4844-22-0x000001E71FAC0000-0x000001E71FAFC000-memory.dmp

memory/4844-26-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

memory/4844-27-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

memory/2772-29-0x000001D36FD10000-0x000001D36FE1A000-memory.dmp

C:\Program Files\WindowsFirewall\runtime.exe

MD5 83cc0cba6f510ad5eb3142f10019e36b
SHA1 e0f4545ef4c967a8a22a1b4790a88b6fe679446b
SHA256 2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1
SHA512 7a87f2dbb054495a1f91b8bd7c1dd232314d3eca1b3b95798af0eb7518a99bd6f585124e9ac9f1f06c144ed9ce6b9efe5bf674141b83ac177484a786948a81fd

memory/4568-45-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

memory/4148-46-0x0000022645C50000-0x0000022645CA8000-memory.dmp

memory/4148-48-0x000002262D250000-0x000002262D268000-memory.dmp

memory/4148-49-0x000002262D230000-0x000002262D240000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows_Services.exe

MD5 8ace06702ec59d170ca2b31f95812e0f
SHA1 de36712adf9b67d0b4c99d12eb59361adfc5473f
SHA256 f74d37fae8e3fb82eff8d6acf755687d9fb38403c38512ad794f16d5b471ce45
SHA512 5d4dc9ad439f66a17f286800559f1ad13f798cf633eaa7319f41691f2d11a519cccab568e0dd2cadebe4258f51d760fab9ca67e7ecb6c97ff496c9308de6cec5

C:\Users\Admin\AppData\Roaming\Windows_Services.exe.config

MD5 740dde6369b1c855ea2f8e171fa888c8
SHA1 db3f1c7e5e4c087cf9eb02376fd750f1879f28f8
SHA256 e03c480b46464159387618445ca9fd9870b53e092e2278837f2d5a54daf06cae
SHA512 114607dcee4439e5e5c97ca986a65c8114a0e3f3c56f494ef6eaac9cb0f9ebf29b828aabc3100e4be197c94d54a7c26513942c56806bfb3bb0d3594ffef7458c

memory/4000-63-0x0000000000650000-0x0000000000658000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows_Services.exe.log

MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1