Analysis
-
max time kernel
26s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 13:33
Behavioral task
behavioral1
Sample
5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe
-
Size
1.5MB
-
MD5
18fc193b873fe0b1bec71f9adb81b980
-
SHA1
22e26e736643fde32ce7afa3c60af3c4bec9e9fe
-
SHA256
5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060
-
SHA512
b2ab211ccf0f000e3467aae352a70cb2025226efb091f0f87761857b1e1432026895207d1473d2f6c152fb8364e7d8d775698d20c21917884fde3300478eb7aa
-
SSDEEP
24576:Z7f/qIBpJA8uyQh8ce3N1BaSD7hVDaV+nmMUhlHSIN68sqBzc+Fj:99RTkSrDyImlHSIN68sqlc+Fj
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016dd5-2.dat family_neshta behavioral1/files/0x0007000000016dd9-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0013000000010321-17.dat family_neshta behavioral1/files/0x000f00000001033a-16.dat family_neshta behavioral1/memory/2860-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2844-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2984-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1792-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/992-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-99.dat family_neshta behavioral1/files/0x000100000000f776-101.dat family_neshta behavioral1/files/0x000100000000f7ca-102.dat family_neshta behavioral1/files/0x000100000000f7e6-111.dat family_neshta behavioral1/memory/2384-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1280-107-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f703-123.dat family_neshta behavioral1/files/0x000100000000f82d-128.dat family_neshta behavioral1/memory/1972-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f872-138.dat family_neshta behavioral1/files/0x000100000000f82e-137.dat family_neshta behavioral1/files/0x0001000000010b94-141.dat family_neshta behavioral1/memory/2872-154-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2388-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1812-171-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3052-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1096-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1768-189-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/292-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1680-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-208-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3020-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2212-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2464-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2692-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2600-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2448-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1500-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1844-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/828-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/464-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2428-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2772-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2152-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2820 svchost.com 2860 5B2288~1.EXE 2844 svchost.com 2568 5B2288~1.EXE 2676 svchost.com 2984 5B2288~1.EXE 992 svchost.com 1792 5B2288~1.EXE 2084 svchost.com 2848 5B2288~1.EXE 2384 svchost.com 1280 5B2288~1.EXE 1972 svchost.com 1924 5B2288~1.EXE 2872 svchost.com 2388 5B2288~1.EXE 1812 svchost.com 3052 5B2288~1.EXE 1096 svchost.com 1768 5B2288~1.EXE 1180 svchost.com 292 5B2288~1.EXE 1696 svchost.com 1680 5B2288~1.EXE 1732 svchost.com 2488 5B2288~1.EXE 2212 svchost.com 3020 5B2288~1.EXE 2504 svchost.com 2464 5B2288~1.EXE 2704 svchost.com 2756 5B2288~1.EXE 2592 svchost.com 2692 5B2288~1.EXE 2668 svchost.com 2600 5B2288~1.EXE 2632 svchost.com 2828 5B2288~1.EXE 1500 svchost.com 2448 5B2288~1.EXE 2164 svchost.com 1844 5B2288~1.EXE 2460 svchost.com 2084 5B2288~1.EXE 464 svchost.com 828 5B2288~1.EXE 2772 svchost.com 2428 5B2288~1.EXE 2152 svchost.com 1908 5B2288~1.EXE 1916 svchost.com 1980 5B2288~1.EXE 784 svchost.com 1676 5B2288~1.EXE 3064 svchost.com 2012 5B2288~1.EXE 1772 svchost.com 1300 5B2288~1.EXE 1784 svchost.com 948 5B2288~1.EXE 2112 svchost.com 964 5B2288~1.EXE 1768 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2820 svchost.com 2820 svchost.com 2844 svchost.com 2844 svchost.com 2676 svchost.com 2676 svchost.com 992 svchost.com 992 svchost.com 2084 svchost.com 2084 svchost.com 2384 svchost.com 2384 svchost.com 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 1972 svchost.com 1972 svchost.com 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2872 svchost.com 2872 svchost.com 1812 svchost.com 1812 svchost.com 1096 svchost.com 1096 svchost.com 1180 svchost.com 1180 svchost.com 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 1696 svchost.com 1696 svchost.com 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 1732 svchost.com 1732 svchost.com 2212 svchost.com 2212 svchost.com 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 2504 svchost.com 2504 svchost.com 2704 svchost.com 2704 svchost.com 2592 svchost.com 2592 svchost.com 2668 svchost.com 2668 svchost.com 2632 svchost.com 2632 svchost.com 1500 svchost.com 1500 svchost.com 2164 svchost.com 2164 svchost.com 2460 svchost.com 2460 svchost.com 464 svchost.com 464 svchost.com 2772 svchost.com 2772 svchost.com 2152 svchost.com 2152 svchost.com 1916 svchost.com 1916 svchost.com 784 svchost.com 784 svchost.com 3064 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com 5B2288~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 5B2288~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 552 2844 WerFault.exe 501 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2288~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2760 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 30 PID 3040 wrote to memory of 2760 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 30 PID 3040 wrote to memory of 2760 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 30 PID 3040 wrote to memory of 2760 3040 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 30 PID 2760 wrote to memory of 2820 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 31 PID 2760 wrote to memory of 2820 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 31 PID 2760 wrote to memory of 2820 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 31 PID 2760 wrote to memory of 2820 2760 5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe 31 PID 2820 wrote to memory of 2860 2820 svchost.com 32 PID 2820 wrote to memory of 2860 2820 svchost.com 32 PID 2820 wrote to memory of 2860 2820 svchost.com 32 PID 2820 wrote to memory of 2860 2820 svchost.com 32 PID 2860 wrote to memory of 2844 2860 5B2288~1.EXE 33 PID 2860 wrote to memory of 2844 2860 5B2288~1.EXE 33 PID 2860 wrote to memory of 2844 2860 5B2288~1.EXE 33 PID 2860 wrote to memory of 2844 2860 5B2288~1.EXE 33 PID 2844 wrote to memory of 2568 2844 svchost.com 34 PID 2844 wrote to memory of 2568 2844 svchost.com 34 PID 2844 wrote to memory of 2568 2844 svchost.com 34 PID 2844 wrote to memory of 2568 2844 svchost.com 34 PID 2568 wrote to memory of 2676 2568 5B2288~1.EXE 35 PID 2568 wrote to memory of 2676 2568 5B2288~1.EXE 35 PID 2568 wrote to memory of 2676 2568 5B2288~1.EXE 35 PID 2568 wrote to memory of 2676 2568 5B2288~1.EXE 35 PID 2676 wrote to memory of 2984 2676 svchost.com 36 PID 2676 wrote to memory of 2984 2676 svchost.com 36 PID 2676 wrote to memory of 2984 2676 svchost.com 36 PID 2676 wrote to memory of 2984 2676 svchost.com 36 PID 2984 wrote to memory of 992 2984 5B2288~1.EXE 37 PID 2984 wrote to memory of 992 2984 5B2288~1.EXE 37 PID 2984 wrote to memory of 992 2984 5B2288~1.EXE 37 PID 2984 wrote to memory of 992 2984 5B2288~1.EXE 37 PID 992 wrote to memory of 1792 992 svchost.com 38 PID 992 wrote to memory of 1792 992 svchost.com 38 PID 992 wrote to memory of 1792 992 svchost.com 38 PID 992 wrote to memory of 1792 992 svchost.com 38 PID 1792 wrote to memory of 2084 1792 5B2288~1.EXE 74 PID 1792 wrote to memory of 2084 1792 5B2288~1.EXE 74 PID 1792 wrote to memory of 2084 1792 5B2288~1.EXE 74 PID 1792 wrote to memory of 2084 1792 5B2288~1.EXE 74 PID 2084 wrote to memory of 2848 2084 svchost.com 40 PID 2084 wrote to memory of 2848 2084 svchost.com 40 PID 2084 wrote to memory of 2848 2084 svchost.com 40 PID 2084 wrote to memory of 2848 2084 svchost.com 40 PID 2848 wrote to memory of 2384 2848 5B2288~1.EXE 41 PID 2848 wrote to memory of 2384 2848 5B2288~1.EXE 41 PID 2848 wrote to memory of 2384 2848 5B2288~1.EXE 41 PID 2848 wrote to memory of 2384 2848 5B2288~1.EXE 41 PID 2384 wrote to memory of 1280 2384 svchost.com 42 PID 2384 wrote to memory of 1280 2384 svchost.com 42 PID 2384 wrote to memory of 1280 2384 svchost.com 42 PID 2384 wrote to memory of 1280 2384 svchost.com 42 PID 1280 wrote to memory of 1972 1280 5B2288~1.EXE 43 PID 1280 wrote to memory of 1972 1280 5B2288~1.EXE 43 PID 1280 wrote to memory of 1972 1280 5B2288~1.EXE 43 PID 1280 wrote to memory of 1972 1280 5B2288~1.EXE 43 PID 1972 wrote to memory of 1924 1972 svchost.com 44 PID 1972 wrote to memory of 1924 1972 svchost.com 44 PID 1972 wrote to memory of 1924 1972 svchost.com 44 PID 1972 wrote to memory of 1924 1972 svchost.com 44 PID 1924 wrote to memory of 2872 1924 5B2288~1.EXE 45 PID 1924 wrote to memory of 2872 1924 5B2288~1.EXE 45 PID 1924 wrote to memory of 2872 1924 5B2288~1.EXE 45 PID 1924 wrote to memory of 2872 1924 5B2288~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe"C:\Users\Admin\AppData\Local\Temp\5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5b22885aa0b352683fcc4c2d27a58bca4c8f229de1d2d36cf419cb625985f060N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2388 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE20⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE22⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE26⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE28⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE32⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE34⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE36⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE40⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE44⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE46⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE48⤵
- Executes dropped EXE
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE50⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1908 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE54⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE56⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE58⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"59⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE60⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"61⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE62⤵
- Executes dropped EXE
PID:948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"63⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE64⤵
- Executes dropped EXE
PID:964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"65⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE66⤵PID:492
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"67⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"69⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE70⤵PID:604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"71⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE72⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"75⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE76⤵PID:1220
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"77⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE78⤵
- Drops file in Windows directory
PID:2240 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE80⤵
- Drops file in Windows directory
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"81⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE82⤵PID:2892
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"83⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE84⤵PID:2824
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"85⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE86⤵
- Drops file in Windows directory
PID:2980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"87⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE88⤵PID:2676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"89⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE90⤵PID:2064
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE92⤵PID:2852
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"93⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE94⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"95⤵
- Drops file in Windows directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE96⤵PID:2616
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"97⤵
- Drops file in Windows directory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE98⤵PID:2244
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"99⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE100⤵PID:2644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"101⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE102⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"103⤵
- Drops file in Windows directory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE104⤵
- Drops file in Windows directory
PID:784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"105⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE106⤵PID:2392
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"107⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE108⤵PID:1772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"109⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE110⤵PID:2516
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE112⤵
- Drops file in Windows directory
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"113⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE114⤵
- Drops file in Windows directory
PID:1780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"115⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE116⤵PID:2364
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"117⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE118⤵PID:904
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE120⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\5B2288~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-