Analysis
-
max time kernel
23s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-01-2025 22:57
Behavioral task
behavioral1
Sample
vaultFile11006347749467126253.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
vaultFile11006347749467126253.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
vaultFile11006347749467126253.exe
-
Size
4.1MB
-
MD5
a9dd2982d7f123950a6865bd7b59906a
-
SHA1
1f258810190dca1cfcc34dc3adfb083255f23330
-
SHA256
92b303f29d883e414190f1263ea4ad7a6e556dfab7d3e0fd91bbae133c125a52
-
SHA512
f15472a17653c585f6b4bf4be097119be01b2c77ecefe8271fd8024ba3ab51962fef40f13f395b4db534420846e9e80f35e3c13116f580cf3908daa0fc70ba4e
-
SSDEEP
49152:XEBgnnvHwB+yswrZr8mm6LhL02F989+SwEIe9by/uMnoVedHqCchacRcHkAQ6TU:LnvC+GkAJqDJRMI
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x00070000000174a6-2.dat family_neshta behavioral1/files/0x00070000000174c3-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/memory/1216-39-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2216-38-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000700000001033a-18.dat family_neshta behavioral1/files/0x0022000000010678-17.dat family_neshta behavioral1/memory/2756-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2312-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2672-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d3-97.dat family_neshta behavioral1/files/0x000100000000f7d8-100.dat family_neshta behavioral1/files/0x000100000000f776-103.dat family_neshta behavioral1/files/0x000100000000f7ca-106.dat family_neshta behavioral1/files/0x000100000000f7e6-109.dat family_neshta behavioral1/files/0x00010000000117fc-150.dat family_neshta behavioral1/files/0x0001000000010c12-147.dat family_neshta behavioral1/files/0x0001000000010361-144.dat family_neshta behavioral1/files/0x0001000000010b94-141.dat family_neshta behavioral1/files/0x00010000000114c5-138.dat family_neshta behavioral1/files/0x000100000000f872-135.dat family_neshta behavioral1/files/0x000100000000f82d-130.dat family_neshta behavioral1/files/0x000100000000f703-128.dat family_neshta behavioral1/memory/2040-118-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-117-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/592-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1868-193-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1108-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1396-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1880-210-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1860-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/780-222-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1104-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/400-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2076-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1980-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1216-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2696-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2860-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3004-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2632-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1752-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2104-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2500-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/976-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 1456 vaultFile11006347749467126253.exe 1216 svchost.com 2216 VAULTF~1.EXE 2756 svchost.com 2860 VAULTF~1.EXE 2736 svchost.com 3004 VAULTF~1.EXE 2748 svchost.com 2644 VAULTF~1.EXE 2312 svchost.com 2672 VAULTF~1.EXE 2040 svchost.com 2868 VAULTF~1.EXE 592 svchost.com 2000 VAULTF~1.EXE 2148 svchost.com 1868 VAULTF~1.EXE 2932 svchost.com 1108 VAULTF~1.EXE 1880 svchost.com 1396 VAULTF~1.EXE 1860 svchost.com 780 VAULTF~1.EXE 2596 svchost.com 1104 VAULTF~1.EXE 2788 svchost.com 400 VAULTF~1.EXE 1980 svchost.com 2076 VAULTF~1.EXE 2696 svchost.com 1216 VAULTF~1.EXE 2816 svchost.com 2740 VAULTF~1.EXE 2860 svchost.com 2832 VAULTF~1.EXE 2648 svchost.com 3004 VAULTF~1.EXE 2632 svchost.com 1752 VAULTF~1.EXE 2104 svchost.com 2500 VAULTF~1.EXE 1492 svchost.com 2876 VAULTF~1.EXE 1640 svchost.com 2700 VAULTF~1.EXE 2880 svchost.com 976 VAULTF~1.EXE 2868 svchost.com 2924 VAULTF~1.EXE 1992 svchost.com 2068 VAULTF~1.EXE 2992 svchost.com 2708 VAULTF~1.EXE 1996 svchost.com 2568 VAULTF~1.EXE 1336 svchost.com 448 VAULTF~1.EXE 2380 svchost.com 2136 VAULTF~1.EXE 1028 svchost.com 1108 VAULTF~1.EXE 1764 svchost.com 2300 VAULTF~1.EXE 1676 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1924 vaultFile11006347749467126253.exe 1924 vaultFile11006347749467126253.exe 1216 svchost.com 1216 svchost.com 2756 svchost.com 2756 svchost.com 2736 svchost.com 2736 svchost.com 2748 svchost.com 2748 svchost.com 2312 svchost.com 2312 svchost.com 2040 svchost.com 2040 svchost.com 1924 vaultFile11006347749467126253.exe 1456 vaultFile11006347749467126253.exe 592 svchost.com 592 svchost.com 2148 svchost.com 2148 svchost.com 2932 svchost.com 2932 svchost.com 1880 svchost.com 1880 svchost.com 1860 svchost.com 1860 svchost.com 2596 svchost.com 2596 svchost.com 1456 vaultFile11006347749467126253.exe 2788 svchost.com 2788 svchost.com 1980 svchost.com 1980 svchost.com 1456 vaultFile11006347749467126253.exe 2696 svchost.com 2696 svchost.com 1456 vaultFile11006347749467126253.exe 2816 svchost.com 2816 svchost.com 2860 svchost.com 2860 svchost.com 2648 svchost.com 2648 svchost.com 2632 svchost.com 2632 svchost.com 2104 svchost.com 2104 svchost.com 1492 svchost.com 1492 svchost.com 1640 svchost.com 1640 svchost.com 2880 svchost.com 2880 svchost.com 2868 svchost.com 2868 svchost.com 1992 svchost.com 1992 svchost.com 2992 svchost.com 2992 svchost.com 1996 svchost.com 1996 svchost.com 1336 svchost.com 1336 svchost.com 2380 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" vaultFile11006347749467126253.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe vaultFile11006347749467126253.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE vaultFile11006347749467126253.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys VAULTF~1.EXE File opened for modification C:\Windows\svchost.com VAULTF~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAULTF~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" vaultFile11006347749467126253.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1456 1924 vaultFile11006347749467126253.exe 30 PID 1924 wrote to memory of 1456 1924 vaultFile11006347749467126253.exe 30 PID 1924 wrote to memory of 1456 1924 vaultFile11006347749467126253.exe 30 PID 1924 wrote to memory of 1456 1924 vaultFile11006347749467126253.exe 30 PID 1456 wrote to memory of 1216 1456 vaultFile11006347749467126253.exe 31 PID 1456 wrote to memory of 1216 1456 vaultFile11006347749467126253.exe 31 PID 1456 wrote to memory of 1216 1456 vaultFile11006347749467126253.exe 31 PID 1456 wrote to memory of 1216 1456 vaultFile11006347749467126253.exe 31 PID 1216 wrote to memory of 2216 1216 svchost.com 32 PID 1216 wrote to memory of 2216 1216 svchost.com 32 PID 1216 wrote to memory of 2216 1216 svchost.com 32 PID 1216 wrote to memory of 2216 1216 svchost.com 32 PID 2216 wrote to memory of 2756 2216 VAULTF~1.EXE 33 PID 2216 wrote to memory of 2756 2216 VAULTF~1.EXE 33 PID 2216 wrote to memory of 2756 2216 VAULTF~1.EXE 33 PID 2216 wrote to memory of 2756 2216 VAULTF~1.EXE 33 PID 2756 wrote to memory of 2860 2756 svchost.com 63 PID 2756 wrote to memory of 2860 2756 svchost.com 63 PID 2756 wrote to memory of 2860 2756 svchost.com 63 PID 2756 wrote to memory of 2860 2756 svchost.com 63 PID 2860 wrote to memory of 2736 2860 VAULTF~1.EXE 35 PID 2860 wrote to memory of 2736 2860 VAULTF~1.EXE 35 PID 2860 wrote to memory of 2736 2860 VAULTF~1.EXE 35 PID 2860 wrote to memory of 2736 2860 VAULTF~1.EXE 35 PID 2736 wrote to memory of 3004 2736 svchost.com 66 PID 2736 wrote to memory of 3004 2736 svchost.com 66 PID 2736 wrote to memory of 3004 2736 svchost.com 66 PID 2736 wrote to memory of 3004 2736 svchost.com 66 PID 3004 wrote to memory of 2748 3004 VAULTF~1.EXE 37 PID 3004 wrote to memory of 2748 3004 VAULTF~1.EXE 37 PID 3004 wrote to memory of 2748 3004 VAULTF~1.EXE 37 PID 3004 wrote to memory of 2748 3004 VAULTF~1.EXE 37 PID 2748 wrote to memory of 2644 2748 svchost.com 38 PID 2748 wrote to memory of 2644 2748 svchost.com 38 PID 2748 wrote to memory of 2644 2748 svchost.com 38 PID 2748 wrote to memory of 2644 2748 svchost.com 38 PID 2644 wrote to memory of 2312 2644 VAULTF~1.EXE 39 PID 2644 wrote to memory of 2312 2644 VAULTF~1.EXE 39 PID 2644 wrote to memory of 2312 2644 VAULTF~1.EXE 39 PID 2644 wrote to memory of 2312 2644 VAULTF~1.EXE 39 PID 2312 wrote to memory of 2672 2312 svchost.com 40 PID 2312 wrote to memory of 2672 2312 svchost.com 40 PID 2312 wrote to memory of 2672 2312 svchost.com 40 PID 2312 wrote to memory of 2672 2312 svchost.com 40 PID 2672 wrote to memory of 2040 2672 VAULTF~1.EXE 41 PID 2672 wrote to memory of 2040 2672 VAULTF~1.EXE 41 PID 2672 wrote to memory of 2040 2672 VAULTF~1.EXE 41 PID 2672 wrote to memory of 2040 2672 VAULTF~1.EXE 41 PID 2040 wrote to memory of 2868 2040 svchost.com 77 PID 2040 wrote to memory of 2868 2040 svchost.com 77 PID 2040 wrote to memory of 2868 2040 svchost.com 77 PID 2040 wrote to memory of 2868 2040 svchost.com 77 PID 2868 wrote to memory of 592 2868 VAULTF~1.EXE 130 PID 2868 wrote to memory of 592 2868 VAULTF~1.EXE 130 PID 2868 wrote to memory of 592 2868 VAULTF~1.EXE 130 PID 2868 wrote to memory of 592 2868 VAULTF~1.EXE 130 PID 592 wrote to memory of 2000 592 svchost.com 44 PID 592 wrote to memory of 2000 592 svchost.com 44 PID 592 wrote to memory of 2000 592 svchost.com 44 PID 592 wrote to memory of 2000 592 svchost.com 44 PID 2000 wrote to memory of 2148 2000 VAULTF~1.EXE 45 PID 2000 wrote to memory of 2148 2000 VAULTF~1.EXE 45 PID 2000 wrote to memory of 2148 2000 VAULTF~1.EXE 45 PID 2000 wrote to memory of 2148 2000 VAULTF~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\vaultFile11006347749467126253.exe"C:\Users\Admin\AppData\Local\Temp\vaultFile11006347749467126253.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\vaultFile11006347749467126253.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\vaultFile11006347749467126253.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE18⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE20⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE22⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE24⤵
- Executes dropped EXE
PID:780 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE26⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE28⤵
- Executes dropped EXE
PID:400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE30⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE32⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE34⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE36⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE38⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE40⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2500 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE46⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE48⤵
- Executes dropped EXE
PID:976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE50⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE56⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE58⤵
- Executes dropped EXE
PID:448 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE60⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"61⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE62⤵
- Executes dropped EXE
PID:1108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"63⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE64⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"65⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE66⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"67⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE68⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"69⤵
- Drops file in Windows directory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE70⤵PID:2584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"71⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE72⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"73⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE74⤵PID:2244
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"75⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE76⤵
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE78⤵PID:1148
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"79⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE80⤵PID:1216
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"81⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE82⤵PID:2080
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE84⤵PID:2988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"85⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"87⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE88⤵
- Drops file in Windows directory
PID:2664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"89⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE90⤵PID:604
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE92⤵
- Drops file in Windows directory
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"93⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"95⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE96⤵
- Drops file in Windows directory
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"97⤵
- System Location Discovery: System Language Discovery
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE98⤵PID:2332
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"99⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE100⤵PID:2188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"101⤵
- Drops file in Windows directory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE102⤵PID:592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"103⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE104⤵PID:1020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"105⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE106⤵PID:1060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"107⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE108⤵
- Drops file in Windows directory
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"109⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE110⤵PID:284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"111⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE112⤵PID:1388
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"113⤵
- Drops file in Windows directory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE114⤵PID:1844
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"115⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE116⤵
- Drops file in Windows directory
PID:628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"117⤵
- Drops file in Windows directory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE118⤵
- System Location Discovery: System Language Discovery
PID:1768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"119⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE120⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\VAULTF~1.EXE"121⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-