Malware Analysis Report

2025-03-15 06:45

Sample ID 250125-l2akxayrgm
Target UZI.exe
SHA256 6e5aa4eae614ca049a1b2c8b803e6610b2b176a8e009ddad8df221c5899bb0ac
Tags
orcus defense_evasion rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6e5aa4eae614ca049a1b2c8b803e6610b2b176a8e009ddad8df221c5899bb0ac

Threat Level: Known bad

The file UZI.exe was found to be: Known bad.

Malicious Activity Summary

orcus defense_evasion rat spyware stealer

Orcus

Orcurs Rat Executable

Orcus family

Orcus main payload

Orcurs Rat Executable

Indicator Removal: Clear Windows Event Logs

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

NTFS ADS

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-25 10:01

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-25 10:01

Reported

2025-01-25 10:04

Platform

win11-20241023-en

Max time kernel

150s

Max time network

151s

Command Line

winlogon.exe

Signatures

Orcus

rat spyware stealer orcus

Orcus family

orcus

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A

Indicator Removal: Clear Windows Event Logs

defense_evasion
Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx C:\Windows\System32\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\svchost.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={1AFC888A-91A0-4B6D-80BA-C3D20B0DF7C6}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 25 Jan 2025 10:03:13 GMT" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1737799391" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\svchost.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION C:\Windows\system32\wbem\wmiprvse.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\SCHTASKS.exe N/A
N/A N/A C:\Windows\SYSTEM32\SCHTASKS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe
PID 4780 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe
PID 4780 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\SYSTEM32\SCHTASKS.exe
PID 4780 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\SYSTEM32\SCHTASKS.exe
PID 4888 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\winlogon.exe
PID 4888 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\lsass.exe
PID 4888 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\dwm.exe
PID 4888 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\spoolsv.exe
PID 4888 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\sysmon.exe
PID 4888 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\sihost.exe
PID 4888 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\wbem\unsecapp.exe
PID 4888 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\Explorer.EXE
PID 4888 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\RuntimeBroker.exe
PID 4888 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\RuntimeBroker.exe
PID 4888 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\DllHost.exe
PID 4888 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\DllHost.exe
PID 4888 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
PID 4888 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\SppExtComObj.exe
PID 4888 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\System32\svchost.exe
PID 4888 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\DllHost.exe
PID 4888 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Windows\system32\svchost.exe
PID 4888 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe C:\Users\Admin\AppData\Local\Temp\UZI.exe
PID 4780 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\UZI.exe C:\Windows\SYSTEM32\SCHTASKS.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Users\Admin\AppData\Local\Temp\UZI.exe

"C:\Users\Admin\AppData\Local\Temp\UZI.exe"

C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe

"C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe"

C:\Windows\SYSTEM32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\SYSTEM32\SCHTASKS.exe

"SCHTASKS.exe" /create /tn "MasonUZI.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\UZI.exe'" /sc onlogon /rl HIGHEST

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Network

Country Destination Domain Proto
NL 195.88.218.126:10134 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
NL 195.88.218.126:10134 tcp

Files

memory/4780-0-0x00007FF834CF3000-0x00007FF834CF5000-memory.dmp

memory/4780-1-0x0000024068D20000-0x0000024068E3A000-memory.dmp

memory/4780-2-0x000002406AB20000-0x000002406AB4C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\n3eeylod.ptu.exe

MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c

memory/4888-11-0x00007FF855B80000-0x00007FF855D89000-memory.dmp

memory/4888-13-0x00007FF855B81000-0x00007FF855CAA000-memory.dmp

memory/4888-14-0x00007FF855B80000-0x00007FF855D89000-memory.dmp

memory/4888-12-0x00007FF854B00000-0x00007FF854BBD000-memory.dmp

memory/640-17-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/988-32-0x00000277BA4D0000-0x00000277BA4FB000-memory.dmp

memory/988-35-0x00000277BA4D0000-0x00000277BA4FB000-memory.dmp

memory/444-40-0x000001CFE41A0000-0x000001CFE41CB000-memory.dmp

memory/3224-78-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/908-82-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/4780-150-0x00007FF834CF3000-0x00007FF834CF5000-memory.dmp

memory/908-81-0x00000210EF590000-0x00000210EF5BB000-memory.dmp

memory/3224-77-0x0000000002E20000-0x0000000002E4B000-memory.dmp

memory/444-38-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/444-37-0x000001CFE41A0000-0x000001CFE41CB000-memory.dmp

memory/988-33-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/468-31-0x0000024178000000-0x000002417802B000-memory.dmp

memory/696-30-0x0000028ED4FD0000-0x0000028ED4FFB000-memory.dmp

memory/640-29-0x00007FF855C24000-0x00007FF855C25000-memory.dmp

memory/640-28-0x000001CF38C30000-0x000001CF38C5B000-memory.dmp

memory/468-26-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/468-25-0x0000024178000000-0x000002417802B000-memory.dmp

memory/696-21-0x00007FF815C10000-0x00007FF815C20000-memory.dmp

memory/696-20-0x0000028ED4FD0000-0x0000028ED4FFB000-memory.dmp

memory/640-16-0x000001CF38C30000-0x000001CF38C5B000-memory.dmp

memory/640-15-0x000001CF38C00000-0x000001CF38C25000-memory.dmp

memory/4780-272-0x000002406B700000-0x000002406B7E8000-memory.dmp

memory/4780-275-0x000002406B4F0000-0x000002406B500000-memory.dmp

memory/4888-274-0x00007FF855B80000-0x00007FF855D89000-memory.dmp

memory/4780-276-0x000002406B7F0000-0x000002406B84C000-memory.dmp

memory/4780-277-0x000002406B4E0000-0x000002406B4EE000-memory.dmp

memory/4780-278-0x000002406C2E0000-0x000002406C2F2000-memory.dmp

memory/4780-279-0x000002406C2F0000-0x000002406C308000-memory.dmp

memory/4780-280-0x000002406C2D0000-0x000002406C2E0000-memory.dmp

memory/988-283-0x00000277BA4D0000-0x00000277BA4FB000-memory.dmp

memory/444-288-0x000001CFE41A0000-0x000001CFE41CB000-memory.dmp

memory/4780-292-0x000002406C590000-0x000002406C5A2000-memory.dmp

memory/4780-293-0x000002406C5F0000-0x000002406C62C000-memory.dmp

memory/4780-294-0x000002406C740000-0x000002406C84A000-memory.dmp

memory/4780-295-0x000002406E2D0000-0x000002406E492000-memory.dmp

memory/4780-296-0x000002406B4F0000-0x000002406B500000-memory.dmp