Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 23:09
Behavioral task
behavioral1
Sample
028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
300 seconds
General
-
Target
028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe
-
Size
391KB
-
MD5
bc1235b936dea3cf19830d6d6fb39594
-
SHA1
d51a0c9489c5a7117decd98f06c03d99d9f2e009
-
SHA256
028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8
-
SHA512
4b02aec7f2b2a0752335c647a31fa44d2e6e5557bffc6894520ed37247f47ee80aa5a6da070d2cea8c7cf0e980abaf7a81c6cb2d78e5ddd92f1176118362a59b
-
SSDEEP
6144:k9t/B5fpRr3TmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUt:c/B5fn5cqj4D
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000800000001748f-2.dat family_neshta behavioral1/files/0x000700000001752f-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0007000000010348-17.dat family_neshta behavioral1/files/0x0033000000010618-16.dat family_neshta behavioral1/memory/2784-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2776-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2212-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1824-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2208-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-84.dat family_neshta behavioral1/files/0x000100000000f7e6-106.dat family_neshta behavioral1/files/0x000100000000f7ca-96.dat family_neshta behavioral1/files/0x000100000000f776-95.dat family_neshta behavioral1/files/0x000100000000f7d8-94.dat family_neshta behavioral1/memory/1476-93-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1800-92-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-118-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-117-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010370-135.dat family_neshta behavioral1/files/0x0001000000010b94-132.dat family_neshta behavioral1/files/0x0001000000010c12-138.dat family_neshta behavioral1/memory/788-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1432-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x00010000000117fc-142.dat family_neshta behavioral1/memory/1964-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/908-165-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1868-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/836-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1552-200-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-199-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-211-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2484-225-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/288-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2020-252-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1720-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1396-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1260-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2128-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1140-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1264-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1916-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3000-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2784 svchost.com 2776 028343~1.EXE 2580 svchost.com 2552 028343~1.EXE 2616 svchost.com 2212 028343~1.EXE 1824 svchost.com 2208 028343~1.EXE 1800 svchost.com 1476 028343~1.EXE 2904 svchost.com 2924 028343~1.EXE 788 svchost.com 1432 028343~1.EXE 1964 svchost.com 908 028343~1.EXE 1868 svchost.com 836 028343~1.EXE 2252 svchost.com 1552 028343~1.EXE 1640 svchost.com 2444 028343~1.EXE 288 svchost.com 2484 028343~1.EXE 1644 svchost.com 2020 028343~1.EXE 1720 svchost.com 2828 028343~1.EXE 2672 svchost.com 2840 028343~1.EXE 2820 svchost.com 2092 028343~1.EXE 1976 svchost.com 1396 028343~1.EXE 2540 svchost.com 1260 028343~1.EXE 2396 svchost.com 2128 028343~1.EXE 1636 svchost.com 1140 028343~1.EXE 2740 svchost.com 2868 028343~1.EXE 2860 svchost.com 2320 028343~1.EXE 2928 svchost.com 2952 028343~1.EXE 1916 svchost.com 1264 028343~1.EXE 3000 svchost.com 568 028343~1.EXE 2384 svchost.com 2104 028343~1.EXE 2248 svchost.com 1316 028343~1.EXE 2240 svchost.com 992 028343~1.EXE 1272 svchost.com 1256 028343~1.EXE 2056 svchost.com 592 028343~1.EXE 1704 svchost.com 2508 028343~1.EXE 2340 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2784 svchost.com 2784 svchost.com 2580 svchost.com 2580 svchost.com 2616 svchost.com 2616 svchost.com 1824 svchost.com 1824 svchost.com 1800 svchost.com 1800 svchost.com 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2904 svchost.com 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2904 svchost.com 788 svchost.com 788 svchost.com 1964 svchost.com 1964 svchost.com 1868 svchost.com 1868 svchost.com 2252 svchost.com 2252 svchost.com 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 1640 svchost.com 1640 svchost.com 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 288 svchost.com 288 svchost.com 1644 svchost.com 1644 svchost.com 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 1720 svchost.com 1720 svchost.com 2672 svchost.com 2672 svchost.com 2820 svchost.com 2820 svchost.com 1976 svchost.com 1976 svchost.com 2540 svchost.com 2540 svchost.com 2396 svchost.com 2396 svchost.com 1636 svchost.com 1636 svchost.com 2740 svchost.com 2740 svchost.com 2860 svchost.com 2860 svchost.com 2928 svchost.com 2928 svchost.com 1916 svchost.com 1916 svchost.com 3000 svchost.com 3000 svchost.com 2384 svchost.com 2384 svchost.com 2248 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\svchost.com 028343~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE File opened for modification C:\Windows\directx.sys 028343~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028343~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2660 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 30 PID 2648 wrote to memory of 2660 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 30 PID 2648 wrote to memory of 2660 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 30 PID 2648 wrote to memory of 2660 2648 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 30 PID 2660 wrote to memory of 2784 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 31 PID 2660 wrote to memory of 2784 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 31 PID 2660 wrote to memory of 2784 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 31 PID 2660 wrote to memory of 2784 2660 028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe 31 PID 2784 wrote to memory of 2776 2784 svchost.com 32 PID 2784 wrote to memory of 2776 2784 svchost.com 32 PID 2784 wrote to memory of 2776 2784 svchost.com 32 PID 2784 wrote to memory of 2776 2784 svchost.com 32 PID 2776 wrote to memory of 2580 2776 028343~1.EXE 33 PID 2776 wrote to memory of 2580 2776 028343~1.EXE 33 PID 2776 wrote to memory of 2580 2776 028343~1.EXE 33 PID 2776 wrote to memory of 2580 2776 028343~1.EXE 33 PID 2580 wrote to memory of 2552 2580 svchost.com 34 PID 2580 wrote to memory of 2552 2580 svchost.com 34 PID 2580 wrote to memory of 2552 2580 svchost.com 34 PID 2580 wrote to memory of 2552 2580 svchost.com 34 PID 2552 wrote to memory of 2616 2552 028343~1.EXE 35 PID 2552 wrote to memory of 2616 2552 028343~1.EXE 35 PID 2552 wrote to memory of 2616 2552 028343~1.EXE 35 PID 2552 wrote to memory of 2616 2552 028343~1.EXE 35 PID 2616 wrote to memory of 2212 2616 svchost.com 36 PID 2616 wrote to memory of 2212 2616 svchost.com 36 PID 2616 wrote to memory of 2212 2616 svchost.com 36 PID 2616 wrote to memory of 2212 2616 svchost.com 36 PID 2212 wrote to memory of 1824 2212 028343~1.EXE 37 PID 2212 wrote to memory of 1824 2212 028343~1.EXE 37 PID 2212 wrote to memory of 1824 2212 028343~1.EXE 37 PID 2212 wrote to memory of 1824 2212 028343~1.EXE 37 PID 1824 wrote to memory of 2208 1824 svchost.com 38 PID 1824 wrote to memory of 2208 1824 svchost.com 38 PID 1824 wrote to memory of 2208 1824 svchost.com 38 PID 1824 wrote to memory of 2208 1824 svchost.com 38 PID 2208 wrote to memory of 1800 2208 028343~1.EXE 39 PID 2208 wrote to memory of 1800 2208 028343~1.EXE 39 PID 2208 wrote to memory of 1800 2208 028343~1.EXE 39 PID 2208 wrote to memory of 1800 2208 028343~1.EXE 39 PID 1800 wrote to memory of 1476 1800 svchost.com 40 PID 1800 wrote to memory of 1476 1800 svchost.com 40 PID 1800 wrote to memory of 1476 1800 svchost.com 40 PID 1800 wrote to memory of 1476 1800 svchost.com 40 PID 1476 wrote to memory of 2904 1476 028343~1.EXE 41 PID 1476 wrote to memory of 2904 1476 028343~1.EXE 41 PID 1476 wrote to memory of 2904 1476 028343~1.EXE 41 PID 1476 wrote to memory of 2904 1476 028343~1.EXE 41 PID 2904 wrote to memory of 2924 2904 svchost.com 42 PID 2904 wrote to memory of 2924 2904 svchost.com 42 PID 2904 wrote to memory of 2924 2904 svchost.com 42 PID 2904 wrote to memory of 2924 2904 svchost.com 42 PID 2924 wrote to memory of 788 2924 028343~1.EXE 43 PID 2924 wrote to memory of 788 2924 028343~1.EXE 43 PID 2924 wrote to memory of 788 2924 028343~1.EXE 43 PID 2924 wrote to memory of 788 2924 028343~1.EXE 43 PID 788 wrote to memory of 1432 788 svchost.com 44 PID 788 wrote to memory of 1432 788 svchost.com 44 PID 788 wrote to memory of 1432 788 svchost.com 44 PID 788 wrote to memory of 1432 788 svchost.com 44 PID 1432 wrote to memory of 1964 1432 028343~1.EXE 45 PID 1432 wrote to memory of 1964 1432 028343~1.EXE 45 PID 1432 wrote to memory of 1964 1432 028343~1.EXE 45 PID 1432 wrote to memory of 1964 1432 028343~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe"C:\Users\Admin\AppData\Local\Temp\028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\028343f7cf9661471bdf9b9a6923797a963211f91edf4678bf66c52aca7838e8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE18⤵
- Executes dropped EXE
PID:908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE22⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:288 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE26⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE28⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE30⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE34⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE36⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE38⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE40⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE48⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE52⤵
- Executes dropped EXE
PID:568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE54⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE56⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"57⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE58⤵
- Executes dropped EXE
PID:992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"59⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"61⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE62⤵
- Executes dropped EXE
PID:592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE64⤵
- Executes dropped EXE
PID:2508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"65⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE66⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"67⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE68⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"69⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE70⤵
- Drops file in Windows directory
PID:2348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"71⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE72⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"73⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE74⤵PID:2756
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"75⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE76⤵PID:2908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE78⤵PID:2564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE80⤵PID:2180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"81⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE82⤵
- Drops file in Windows directory
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"83⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE84⤵
- Drops file in Windows directory
PID:2212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"85⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE86⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"87⤵
- Drops file in Windows directory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE88⤵PID:564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"89⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE90⤵PID:2448
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"91⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE92⤵PID:2880
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"93⤵
- Drops file in Windows directory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE94⤵PID:696
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"95⤵
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE96⤵
- Drops file in Windows directory
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"97⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE98⤵PID:2748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"99⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE100⤵PID:2424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE102⤵
- Drops file in Windows directory
PID:872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"103⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE104⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"105⤵
- Drops file in Windows directory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE106⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"107⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE108⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE110⤵
- Drops file in Windows directory
PID:2004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"111⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE112⤵PID:2476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"115⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE116⤵PID:2044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"117⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE118⤵PID:1612
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"119⤵
- Drops file in Windows directory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE120⤵PID:2608
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\028343~1.EXE"121⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-