Analysis
-
max time kernel
19s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 19:36
Behavioral task
behavioral1
Sample
87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
60 seconds
Behavioral task
behavioral2
Sample
87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
60 seconds
General
-
Target
87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe
-
Size
319KB
-
MD5
2fd75acf39b68cbdae7373e757e808d4
-
SHA1
73204840cee1e8d2d7ed8c91210799df3c7b1fe1
-
SHA256
87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5
-
SHA512
40215259f2bbf65d010774c5049dbc9ddc85a4fd66500825071dd54719d740ba6c3ccbd84d0f98eb1d73650a8a508637a517ae65fe3758ddf27ace315e0b9e1f
-
SSDEEP
3072:sr85CUT4EDurMC9r7BWPJER27aQDtiIx9tdMgKbXooE3Gr85Cxr85C:k9UTJurMCaRu27qIx3dIb4o9N9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000f000000017390-9.dat family_neshta behavioral1/files/0x0001000000010318-20.dat family_neshta behavioral1/files/0x0001000000010316-19.dat family_neshta behavioral1/files/0x001400000000f842-18.dat family_neshta behavioral1/files/0x005b00000001032b-17.dat family_neshta behavioral1/files/0x00080000000173b2-16.dat family_neshta behavioral1/memory/2960-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2696-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2576-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1104-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3056-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2196-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1404-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-126.dat family_neshta behavioral1/memory/592-133-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f77b-145.dat family_neshta behavioral1/files/0x000100000000f7dd-144.dat family_neshta behavioral1/memory/792-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2260-156-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2420-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/684-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/448-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1620-188-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/916-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/800-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/468-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1276-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-232-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2584-248-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2604-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-271-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/348-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2236-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1920-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/788-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2024-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2364-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/588-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/592-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2124-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2228-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1048-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1660-370-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1972-371-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1656-378-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 2960 svchost.com 2588 87FE4E~1.EXE 2696 svchost.com 2576 87FE4E~1.EXE 1980 svchost.com 2564 87FE4E~1.EXE 3056 svchost.com 1104 87FE4E~1.EXE 2196 svchost.com 2388 87FE4E~1.EXE 2772 svchost.com 1404 87FE4E~1.EXE 2796 svchost.com 2104 87FE4E~1.EXE 592 svchost.com 792 87FE4E~1.EXE 2260 svchost.com 2420 87FE4E~1.EXE 448 svchost.com 684 87FE4E~1.EXE 1620 svchost.com 916 87FE4E~1.EXE 800 svchost.com 2084 87FE4E~1.EXE 1948 svchost.com 3016 87FE4E~1.EXE 468 svchost.com 1964 87FE4E~1.EXE 1276 svchost.com 1596 87FE4E~1.EXE 2832 svchost.com 2584 87FE4E~1.EXE 2604 svchost.com 2636 87FE4E~1.EXE 2612 svchost.com 2376 87FE4E~1.EXE 348 svchost.com 2236 87FE4E~1.EXE 1920 svchost.com 788 87FE4E~1.EXE 2388 svchost.com 2648 87FE4E~1.EXE 3068 svchost.com 2024 87FE4E~1.EXE 2364 svchost.com 588 87FE4E~1.EXE 2240 svchost.com 592 87FE4E~1.EXE 2228 svchost.com 2124 87FE4E~1.EXE 1616 svchost.com 1048 87FE4E~1.EXE 1972 svchost.com 1660 87FE4E~1.EXE 1096 svchost.com 1656 87FE4E~1.EXE 1756 svchost.com 2536 87FE4E~1.EXE 1788 svchost.com 3012 87FE4E~1.EXE 2516 svchost.com 3024 87FE4E~1.EXE 1824 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 2960 svchost.com 2960 svchost.com 2696 svchost.com 2696 svchost.com 1980 svchost.com 1980 svchost.com 3056 svchost.com 3056 svchost.com 2196 svchost.com 2196 svchost.com 2772 svchost.com 2772 svchost.com 2796 svchost.com 2796 svchost.com 592 svchost.com 592 svchost.com 2260 svchost.com 2260 svchost.com 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 448 svchost.com 448 svchost.com 1620 svchost.com 1620 svchost.com 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 800 svchost.com 800 svchost.com 1948 svchost.com 1948 svchost.com 468 svchost.com 468 svchost.com 1276 svchost.com 1276 svchost.com 2832 svchost.com 2832 svchost.com 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 2604 svchost.com 2604 svchost.com 2612 svchost.com 2612 svchost.com 348 svchost.com 348 svchost.com 1920 svchost.com 1920 svchost.com 2388 svchost.com 2388 svchost.com 3068 svchost.com 3068 svchost.com 2364 svchost.com 2364 svchost.com 2240 svchost.com 2240 svchost.com 2228 svchost.com 2228 svchost.com 1616 svchost.com 1616 svchost.com 1972 svchost.com 1972 svchost.com 1096 svchost.com 1096 svchost.com 1756 svchost.com 1756 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 87FE4E~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE4E~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2852 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 31 PID 2708 wrote to memory of 2852 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 31 PID 2708 wrote to memory of 2852 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 31 PID 2708 wrote to memory of 2852 2708 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 31 PID 2852 wrote to memory of 2960 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 32 PID 2852 wrote to memory of 2960 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 32 PID 2852 wrote to memory of 2960 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 32 PID 2852 wrote to memory of 2960 2852 87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe 32 PID 2960 wrote to memory of 2588 2960 svchost.com 33 PID 2960 wrote to memory of 2588 2960 svchost.com 33 PID 2960 wrote to memory of 2588 2960 svchost.com 33 PID 2960 wrote to memory of 2588 2960 svchost.com 33 PID 2588 wrote to memory of 2696 2588 87FE4E~1.EXE 34 PID 2588 wrote to memory of 2696 2588 87FE4E~1.EXE 34 PID 2588 wrote to memory of 2696 2588 87FE4E~1.EXE 34 PID 2588 wrote to memory of 2696 2588 87FE4E~1.EXE 34 PID 2696 wrote to memory of 2576 2696 svchost.com 35 PID 2696 wrote to memory of 2576 2696 svchost.com 35 PID 2696 wrote to memory of 2576 2696 svchost.com 35 PID 2696 wrote to memory of 2576 2696 svchost.com 35 PID 2576 wrote to memory of 1980 2576 87FE4E~1.EXE 36 PID 2576 wrote to memory of 1980 2576 87FE4E~1.EXE 36 PID 2576 wrote to memory of 1980 2576 87FE4E~1.EXE 36 PID 2576 wrote to memory of 1980 2576 87FE4E~1.EXE 36 PID 1980 wrote to memory of 2564 1980 svchost.com 37 PID 1980 wrote to memory of 2564 1980 svchost.com 37 PID 1980 wrote to memory of 2564 1980 svchost.com 37 PID 1980 wrote to memory of 2564 1980 svchost.com 37 PID 2564 wrote to memory of 3056 2564 87FE4E~1.EXE 38 PID 2564 wrote to memory of 3056 2564 87FE4E~1.EXE 38 PID 2564 wrote to memory of 3056 2564 87FE4E~1.EXE 38 PID 2564 wrote to memory of 3056 2564 87FE4E~1.EXE 38 PID 3056 wrote to memory of 1104 3056 svchost.com 39 PID 3056 wrote to memory of 1104 3056 svchost.com 39 PID 3056 wrote to memory of 1104 3056 svchost.com 39 PID 3056 wrote to memory of 1104 3056 svchost.com 39 PID 1104 wrote to memory of 2196 1104 87FE4E~1.EXE 40 PID 1104 wrote to memory of 2196 1104 87FE4E~1.EXE 40 PID 1104 wrote to memory of 2196 1104 87FE4E~1.EXE 40 PID 1104 wrote to memory of 2196 1104 87FE4E~1.EXE 40 PID 2196 wrote to memory of 2388 2196 svchost.com 72 PID 2196 wrote to memory of 2388 2196 svchost.com 72 PID 2196 wrote to memory of 2388 2196 svchost.com 72 PID 2196 wrote to memory of 2388 2196 svchost.com 72 PID 2388 wrote to memory of 2772 2388 87FE4E~1.EXE 42 PID 2388 wrote to memory of 2772 2388 87FE4E~1.EXE 42 PID 2388 wrote to memory of 2772 2388 87FE4E~1.EXE 42 PID 2388 wrote to memory of 2772 2388 87FE4E~1.EXE 42 PID 2772 wrote to memory of 1404 2772 svchost.com 116 PID 2772 wrote to memory of 1404 2772 svchost.com 116 PID 2772 wrote to memory of 1404 2772 svchost.com 116 PID 2772 wrote to memory of 1404 2772 svchost.com 116 PID 1404 wrote to memory of 2796 1404 87FE4E~1.EXE 44 PID 1404 wrote to memory of 2796 1404 87FE4E~1.EXE 44 PID 1404 wrote to memory of 2796 1404 87FE4E~1.EXE 44 PID 1404 wrote to memory of 2796 1404 87FE4E~1.EXE 44 PID 2796 wrote to memory of 2104 2796 svchost.com 45 PID 2796 wrote to memory of 2104 2796 svchost.com 45 PID 2796 wrote to memory of 2104 2796 svchost.com 45 PID 2796 wrote to memory of 2104 2796 svchost.com 45 PID 2104 wrote to memory of 592 2104 87FE4E~1.EXE 79 PID 2104 wrote to memory of 592 2104 87FE4E~1.EXE 79 PID 2104 wrote to memory of 592 2104 87FE4E~1.EXE 79 PID 2104 wrote to memory of 592 2104 87FE4E~1.EXE 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe"C:\Users\Admin\AppData\Local\Temp\87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\87fe4ea3481442313c930924682bf69896bef3ea09ebbe5228aa537ef9c815b5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE20⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE22⤵
- Executes dropped EXE
PID:684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE26⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE28⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE32⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE34⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE36⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE38⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE40⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE44⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE46⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE48⤵
- Executes dropped EXE
PID:588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE50⤵
- Executes dropped EXE
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE52⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE54⤵
- Executes dropped EXE
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE56⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE58⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE60⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"61⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE62⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"63⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE64⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE66⤵PID:2092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"67⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE68⤵PID:1236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"69⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE70⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"71⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE72⤵PID:2768
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"73⤵
- Drops file in Windows directory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE74⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"75⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE76⤵PID:304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"77⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE78⤵PID:3032
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"79⤵
- Drops file in Windows directory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE80⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"81⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE82⤵
- Drops file in Windows directory
PID:348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"83⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE84⤵PID:828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"85⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE86⤵PID:2196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE88⤵PID:2648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"89⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE90⤵
- Drops file in Windows directory
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"91⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE92⤵PID:2984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"93⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE94⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"95⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE96⤵PID:2124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"97⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE100⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE102⤵PID:1996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"103⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE104⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"105⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE106⤵PID:1528
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"107⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE108⤵PID:2516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"109⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE110⤵PID:2092
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"111⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"113⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE114⤵PID:2816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"115⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE116⤵PID:2668
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"117⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE118⤵PID:2724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"119⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\87FE4E~1.EXE"121⤵
- Drops file in Windows directory
PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-