Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GiftForYouDashamed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
GiftForYouDashamed.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target GiftForYouDashamed.exe
- Size 4.9MB
- Sample260531-srxe9abs6x
- SHA256 5a8bf1926cc2a16385118e4e57f5ee613b09767d4390a41eff64184182129a85
- MD5 436d827d373fff5c355282d1a6455700
- SHA1 649c40b0065e81252133c3762f3e7b4d2af29caa
- SHA512 f118fa1a8e8d29728a84163260b2f356efa5018e5b2b7a76ebd76f75c3651a692000f0ea7062064de9f91795ab3699b078d50a3490bca2c4fc3f92c0e448f1cc
- SSDEEP 98304:Q/94dHYQkYbK6jdNDENpUouywaGG70hmprprJTO+K35lxCk5:Q14SsjdRMJuywxhhmpFrha356k
- TLSH T123361242F213B68CE429463AC8C18D086760FD4A5E025E6FB658FF45A9333817FB579B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\Hsp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\usbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ramdisk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tpm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\nvmedisk.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\rspndr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\condrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\crashdmp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cimfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rassstp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\RNDISMP.sys cmd.exe File opened for modification C:\Windows\System32\drivers\SerCx2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\spaceparser.sys cmd.exe File opened for modification C:\Windows\System32\drivers\buttonconverter.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wcifs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bttflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\http.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\netvsc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vdrvroot.sys cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\cdrom.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Wdf01000.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wmilib.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mouclass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msrpc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndproxy.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\HvService.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\MTConfig.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rasacd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wanarp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\CAD.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\fltmgr.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\gpuenergydrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\urscx01000.sys cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls cmd.exe File opened for modification C:\Windows\System32\drivers\videoprt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\CEA.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\errdev.sys cmd.exe File opened for modification C:\Windows\System32\drivers\i8042prt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ndistapi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\mslldp.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\modem.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.Legacy.LEEnumerator.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pcmcia.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\pci.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\wdf01000.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\wfplwfs.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hwpolicy.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\SDFLauncher.dll cmd.exe File opened for modification C:\Windows\System32\drivers\flpydisk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\UsbccidDriver.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\circlass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\raspppoe.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UcmTcpciCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\watchdog.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\agilevpn.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\pdc.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\tunnel.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbprint.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pciide.sys cmd.exe File opened for modification C:\Windows\System32\drivers\storqosflt.sys cmd.exe - Manipulates Digital Signatures 4 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll cmd.exe File opened for modification C:\Windows\System32\wintrust.dll cmd.exe - Drops desktop.ini file(s) 14 IoCs
description ioc Process File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMC91F~1.348\f\Desktop.ini cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMA81C~1.348\f\Desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM6E67~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMAF9C~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2C78~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM3BE9~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMD412~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM22CA~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM2F26~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMFB2A~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM038E~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMDDA5~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AMB160~1.1_N\desktop.ini cmd.exe File opened for modification C:\Windows\WinSxS\AM52F5~1.1_N\desktop.ini cmd.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\en-US\DscCoreConfProv.dll.mui cmd.exe File opened for modification C:\Windows\System32\printui.exe cmd.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSScheduledJob\PSScheduledJob.psd1 cmd.exe File opened for modification C:\Windows\SysWOW64\efsadu.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\SHCore.dll.mui cmd.exe File opened for modification C:\Windows\System32\en\fhuxpresentation.Resources.dll cmd.exe File opened for modification C:\Windows\System32\it-IT\scansetting.dll.mui cmd.exe File opened for modification C:\Windows\System32\uk-UA\hnetcfg.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\WindowManagementAPI.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\fr-FR\MSFT_WaitForAll.schema.mfl cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\WSDScDrv.inf_loc cmd.exe File opened for modification C:\Windows\System32\spp\tokens\skus\ENTERP~1\Enterprise-OEM-NONSLP-1-pl-rtm.xrm-ms cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config cmd.exe File opened for modification C:\Windows\System32\fr-FR\NetworkIcon.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\appwiz.cpl.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\percsas2i.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\printui.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\WFSR.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\UcmUcsiAcpiClient.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\USBVID~2.INF\usbvideo.sys cmd.exe File opened for modification C:\Windows\System32\wpnclient.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\auditpolmsg.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\virtdisk.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Windows.ApplicationModel.dll.mui cmd.exe File opened for modification C:\Windows\System32\ja-jp\rdpcorets.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\disk.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\umbus.inf_loc cmd.exe File opened for modification C:\Windows\System32\kdcpw.dll cmd.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe cmd.exe File opened for modification C:\Windows\System32\de-DE\DevicePairing.dll.mui cmd.exe File opened for modification C:\Windows\System32\icsigd.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\MSFT_DAClientExperienceConfiguration.cdxml cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Smb.types.ps1xml cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\srcore.dll.mui cmd.exe File opened for modification C:\Windows\System32\ja-jp\schannel.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\HalExtIntcLpioDma.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\wvmic_guestinterface.inf_loc cmd.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\PROFES~1\license.rtf cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\wlanext.exe.mui cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\TtlsCfg.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\netloop.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\dccw.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\SettingsHandlers_Maps.dll.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\PushToInstall.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\gamingtcui.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\WSMan.Format.ps1xml cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\NTPRIN~2.INF\Amd64\V3HostingFilter.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\e2xw10x64.inf_loc cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\MFC40.dll.mui cmd.exe File opened for modification C:\Windows\System32\container.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\usbvideo.inf_loc cmd.exe File opened for modification C:\Windows\System32\it-IT\PeerDistCleaner.dll.mui cmd.exe File opened for modification C:\Windows\System32\qwinsta.exe cmd.exe File opened for modification C:\Windows\System32\uk-UA\cxcredprov.dll.mui cmd.exe File opened for modification C:\Windows\System32\wbem\en-US\krnlprov.mfl cmd.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEFILES.DLL cmd.exe File opened for modification C:\Windows\SysWOW64\InstallServiceTasks.dll cmd.exe File opened for modification C:\Windows\System32\accountaccessor.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\PCI~2.INF\pci.inf cmd.exe File opened for modification C:\Windows\System32\fveapibase.dll cmd.exe File opened for modification C:\Windows\System32\uk-UA\PeerDistCleaner.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\mmc.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\Windows.UI.Xaml.Phone.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\pnrpsvc.dll.mui cmd.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll cmd.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIDAA5~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AMAA60~1.469\f\UPDATE~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM94ED~1.469\f\LOCALA~1.HTM cmd.exe File opened for modification C:\Windows\WinSxS\AM44A9~1.1_D\CDPUSE~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM9441~1.493\f\license.rtf cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI1FBE~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMF696~1.348\f\DATADI~1.DAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MICF05~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AM8237~1.1_F\APPHEL~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\WO9E51~1.348\f\mssrch.dll cmd.exe File opened for modification C:\Windows\WinSxS\AM2E2A~1.348\MLANGD~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM6968~1.1_N\lusrmgr.msc cmd.exe File opened for modification C:\Windows\diagnostics\system\IESecurity\es-ES\IESecurity_TroubleShooter.psd1 cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM6E79~1.348\f\SYNCRE~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIB595~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\WI65EB~1.MUM cmd.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\SIMLockToast.scale-100_contrast-black.png cmd.exe File opened for modification C:\Windows\WinSxS\AMDBCA~1.469\r\DEVICE~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AM9BFF~1.65_\f\PROVIS~1.DLL cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMB1AC~1.493\f\WINDOW~4.WIN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI8A9D~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\HYCE4C~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM7CA7~1.120\f\REAGEN~1.ADM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM210D~1.132\f\WINDOW~1.DLL cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM5ABF~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\PR4AF1~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AMC07B~1.1_D\w3isapi.mfl cmd.exe File opened for modification C:\Windows\Boot\PCAT\en-GB\bootmgr.exe.mui cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMF426~1.348\f\PR5B4B~1.XRM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM4FF9~1.184\f\SHELL3~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMB1AC~1.493\f\media\HELLOF~1.GIF cmd.exe File opened for modification C:\Windows\servicing\Packages\MIA899~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AM3B1B~1.184\WINDOW~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM2E15~1.1_I\NETMGM~1.MUI cmd.exe File opened for modification C:\Windows\WinSxS\AM01D9~1.1_N\cachhttp.dll cmd.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.targetsize-96_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\CO26C7~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI1D21~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI8449~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI1917~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\Package_4_for_KB5006755~31bf3856ad364e35~amd64~~22000.280.1.0.cat cmd.exe File opened for modification C:\Windows\WinSxS\AM7B60~1.469\MFSENS~1.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMD563~1.1_N\TEXTSE~1.MAN cmd.exe File opened for modification C:\Windows\INF\iaLPSS2i_GPIO2_SKL.inf cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WINDOW~1\_ServiceModelEndpointPerfCounters.reg cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM33D2~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMEC2B~1.MAN cmd.exe File opened for modification C:\Windows\WinSxS\AM6BBA~1.1_J\NDUPRO~1.MUI cmd.exe File opened for modification C:\Windows\servicing\Packages\DI64F8~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\MI9E6F~1.CAT cmd.exe File opened for modification C:\Windows\WinSxS\AMF158~1.1_N\IMJPDCTP.DLL cmd.exe File opened for modification C:\Windows\WinSxS\AMC978~1.1_N\WUDFx.mof cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for SqlServer\0407\_dataperfcounters_shared12_neutral_d.ini cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIBF06~1.MUM cmd.exe File opened for modification C:\Windows\SystemApps\MICROS~1.ASS\Assets\SplashScreen.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\AM4535~1.1_J\MGTDYN~1.INF cmd.exe File opened for modification C:\Windows\WinSxS\AM499A~1.1_F\CIPHER~1.ADM cmd.exe File opened for modification C:\Windows\INF\dc1-controller.inf cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMB1AC~1.493\f\WINRTC~1.DLL cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMF1F4~1.348\f\WWAHOS~1.MUI cmd.exe File opened for modification C:\Windows\servicing\Packages\HYC611~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-FCI-Client-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat cmd.exe File opened for modification C:\Windows\servicing\Packages\MIA194~1.MUM cmd.exe File opened for modification C:\Windows\WinSxS\AM65BF~1.1_N\dmcsps.dll cmd.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5008 wrote to memory of 4888 5008 GiftForYouDashamed.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\GiftForYouDashamed.exe"C:\Users\Admin\AppData\Local\Temp\GiftForYouDashamed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rmdir /s /q C:\Windows2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Windows directory
PID:4888
-