General Info

File name

2018-09-29_20-26-55.exe

Full analysis
https://app.any.run/tasks/ed088f23-46f9-44f9-af9c-28703bab5e39
Verdict
Malicious activity
Analysis date
6/16/2019, 16:42:20
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

trojan

ramnit

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

c51a0bfc921d6721e99a6d0fcae02d73

SHA1

fd6b54e251483bb88d1cedd4ccb065d16e990195

SHA256

ad45cfb13369d393156e9571f239ab9c58c43239067bbc74152d747d32bf3b0d

SSDEEP

6144:WWympplTPwW1jcBOHDQHg0aLBLwpWfA3Danv4:J7pzjcYIsLOpWCD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
180 seconds
Additional time used
120 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Runs injected code in another process
  • svchost.exe (PID: 3900)
Application was injected by another process
  • conhost.exe (PID: 392)
  • taskeng.exe (PID: 3756)
  • windanr.exe (PID: 556)
  • ctfmon.exe (PID: 3780)
  • explorer.exe (PID: 2044)
  • dwm.exe (PID: 1980)
Ramnit was detected
  • conhost.exe (PID: 392)
  • tracert.exe (PID: 1212)
  • explorer.exe (PID: 2044)
  • dwm.exe (PID: 1980)
  • windanr.exe (PID: 556)
  • taskeng.exe (PID: 3756)
  • ctfmon.exe (PID: 3780)
Connects to CnC server
  • svchost.exe (PID: 2620)
Changes the login/logoff helper path in the registry
  • sfseunjd.exe (PID: 3304)
RAMNIT was detected
  • svchost.exe (PID: 2620)
Changes firewall settings
  • sfseunjd.exe (PID: 3304)
Changes the autorun value in the registry
  • sfseunjd.exe (PID: 3304)
  • svchost.exe (PID: 2620)
Modifies Windows security services settings
  • sfseunjd.exe (PID: 3304)
Modifies Windows Defender service settings
  • sfseunjd.exe (PID: 3304)
UAC/LUA settings modification
  • sfseunjd.exe (PID: 3304)
Writes to a start menu file
  • svchost.exe (PID: 2620)
Changes Security Center notification settings
  • sfseunjd.exe (PID: 3304)
Uses SVCHOST.EXE for hidden code execution
  • sfseunjd.exe (PID: 3684)
Reads the cookies of Mozilla Firefox
  • svchost.exe (PID: 3900)
Reads the cookies of Google Chrome
  • svchost.exe (PID: 3900)
Starts CMD.EXE for commands execution
  • iscsicli.exe (PID: 2768)
Creates a software uninstall entry
  • sdbinst.exe (PID: 3988)
Creates files in the Windows directory
  • sdbinst.exe (PID: 3988)
Creates files in the program directory
  • svchost.exe (PID: 2620)
Creates files in the user directory
  • svchost.exe (PID: 2620)
Executable content was dropped or overwritten
  • 2018-09-29_20-26-55.exe (PID: 2836)
  • sfseunjd.exe (PID: 3684)
Starts itself from another location
  • 2018-09-29_20-26-55.exe (PID: 2836)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable MS Visual C++ (generic) (42.2%)
.exe
|   Win64 Executable (generic) (37.3%)
.dll
|   Win32 Dynamic Link Library (generic) (8.8%)
.exe
|   Win32 Executable (generic) (6%)
.exe
|   Generic Win/DOS Executable (2.7%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2018:04:02 12:37:07+02:00
PEType:
PE32
LinkerVersion:
10
CodeSize:
175616
InitializedDataSize:
37888
UninitializedDataSize:
null
EntryPoint:
0x1f33
OSVersion:
5.1
ImageVersion:
null
SubsystemVersion:
5.1
Subsystem:
Windows GUI
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
02-Apr-2018 10:37:07
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x000000E0
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
5
Time date stamp:
02-Apr-2018 10:37:07
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x0002ADBC 0x0002AE00 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.72863
.rdata 0x0002C000 0x00004ABA 0x00004C00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 6.13125
.data 0x00031000 0x00003AA8 0x00002000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 2.52774
.rsrc 0x00035000 0x00005010 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 0
.reloc 0x0003B000 0x000016BA 0x00001800 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 3.88139
Resources

No resources.

Imports
    KERNEL32.dll

    USER32.dll

    ADVAPI32.dll

    SHELL32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
55
Monitored processes
19
Malicious processes
14
Suspicious processes
0

Behavior graph

+
drop and start start inject inject inject inject inject 2018-09-29_20-26-55.exe sfseunjd.exe #RAMNIT svchost.exe svchost.exe sdbinst.exe no specs sdbinst.exe iscsicli.exe no specs iscsicli.exe cmd.exe no specs sfseunjd.exe sdbinst.exe no specs sdbinst.exe dwm.exe explorer.exe taskeng.exe ctfmon.exe windanr.exe #RAMNIT tracert.exe no specs conhost.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
1980
CMD
"C:\Windows\system32\Dwm.exe"
Path
C:\Windows\System32\dwm.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Desktop Window Manager
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\dwmredir.dll
c:\windows\system32\dwmcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\ole32.dll
c:\windows\system32\d3d10_1.dll
c:\windows\system32\d3d10_1core.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\version.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\profapi.dll

PID
2044
CMD
C:\Windows\Explorer.EXE
Path
C:\Windows\explorer.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Windows Explorer
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\slc.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\profapi.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\sndvolsso.dll
c:\windows\system32\hid.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\timedate.cpl
c:\windows\system32\atl.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\actxprxy.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\userenv.dll
c:\windows\system32\shacct.dll
c:\windows\system32\samlib.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\msls31.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\authui.dll
c:\windows\system32\cryptui.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\gameux.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\wer.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msiltcfg.dll
c:\windows\system32\version.dll
c:\windows\system32\msi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\networkexplorer.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wdmaud.drv
c:\windows\system32\ksuser.dll
c:\windows\system32\avrt.dll
c:\windows\system32\audioses.dll
c:\windows\system32\msacm32.drv
c:\windows\system32\msacm32.dll
c:\windows\system32\midimap.dll
c:\windows\system32\stobject.dll
c:\windows\system32\batmeter.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\es.dll
c:\windows\system32\prnfldr.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dxp.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\syncreg.dll
c:\windows\ehome\ehsso.dll
c:\windows\system32\netshell.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\alttab.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
c:\program files\filezilla ftp client\fzshellext.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\taskschd.dll
c:\windows\system32\pnidui.dll
c:\windows\system32\qutil.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\mssprxy.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\wwanapi.dll
c:\windows\system32\wwapi.dll
c:\windows\system32\qagent.dll
c:\windows\system32\srchadmin.dll
c:\windows\system32\sxs.dll
c:\windows\system32\bthprops.cpl
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\synccenter.dll
c:\windows\system32\actioncenter.dll
c:\windows\system32\imapi2.dll
c:\windows\system32\hgcpl.dll
c:\windows\system32\provsvc.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\fxsst.dll
c:\windows\system32\fxsapi.dll
c:\windows\system32\fxsresm.dll
c:\windows\system32\msxml3.dll
c:\program files\internet explorer\ieproxy.dll
c:\windows\system32\systemcpl.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\sppc.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\winsatapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\spinf.dll
c:\windows\system32\wscinterop.dll
c:\windows\system32\wscapi.dll
c:\windows\system32\wscui.cpl
c:\windows\system32\werconcpl.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wercplsupport.dll
c:\windows\system32\hcproviders.dll
c:\windows\system32\mpr.dll
c:\windows\system32\drprov.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\program files\windows sidebar\sbdrop.dll
c:\program files\common files\microsoft shared\office14\msoxev.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\thumbcache.dll
c:\windows\system32\mlang.dll
c:\windows\system32\msutb.dll
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\users\admin\appdata\local\temp\2018-09-29_20-26-55.exe
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll

PID
3756
CMD
taskeng.exe {7E1E8C9A-BE84-4A45-8FE2-CD8D351321B8}
Path
C:\Windows\System32\taskeng.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Task Scheduler Engine
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\tschannel.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll

PID
3780
CMD
C:\Windows\System32\ctfmon.exe
Path
C:\Windows\System32\ctfmon.exe
Indicators
Parent process
taskeng.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
CTF Loader
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msutb.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winsta.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\profapi.dll

PID
556
CMD
"windanr.exe"
Path
C:\Windows\system32\windanr.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\windows\system32\windanr.exe
c:\windows\system32\kernel32.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winanr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\winsanr.dll
c:\windows\system32\psapi.dll
c:\windows\system32\version.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\profapi.dll

PID
2836
CMD
"C:\Users\admin\AppData\Local\Temp\2018-09-29_20-26-55.exe"
Path
C:\Users\admin\AppData\Local\Temp\2018-09-29_20-26-55.exe
Indicators
Parent process
explorer.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\2018-09-29_20-26-55.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\sfseunjd.exe

PID
3684
CMD
C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
Path
C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
Indicators
Parent process
2018-09-29_20-26-55.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\sfseunjd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\propsys.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\sdbinst.exe
c:\windows\system32\mpr.dll
c:\windows\system32\iscsicli.exe

PID
2620
CMD
C:\Windows\system32\svchost.exe
Path
C:\Windows\system32\svchost.exe
Indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Host Process for Windows Services
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll

PID
3900
CMD
C:\Windows\system32\svchost.exe
Path
C:\Windows\system32\svchost.exe
Indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Host Process for Windows Services
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\tracert.exe
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll

PID
2768
CMD
"C:\Windows\system32\sdbinst.exe" /q "C:\Users\admin\AppData\Local\Temp\\..\..\LocalLow\com.admin.sdb"
Path
C:\Windows\system32\sdbinst.exe
Indicators
No indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Microsoft Corporation
Description
Application Compatibility Database Installer
Version
6.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\sdbinst.exe
c:\systemroot\system32\ntdll.dll

PID
3988
CMD
"C:\Windows\system32\sdbinst.exe" /q "C:\Users\admin\AppData\Local\Temp\\..\..\LocalLow\com.admin.sdb"
Path
C:\Windows\system32\sdbinst.exe
Indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Application Compatibility Database Installer
Version
6.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\sdbinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3552
CMD
"C:\Windows\system32\iscsicli.exe"
Path
C:\Windows\system32\iscsicli.exe
Indicators
No indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Microsoft Corporation
Description
iSCSI Discovery tool
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\iscsicli.exe
c:\systemroot\system32\ntdll.dll

PID
2768
CMD
"C:\Windows\system32\iscsicli.exe"
Path
C:\Windows\system32\iscsicli.exe
Indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
iSCSI Discovery tool
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\sdbinst.exe
c:\windows\system32\iscsicli.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\iscsidsc.dll
c:\windows\system32\iscsium.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2676
CMD
cmd /c C:\Users\admin\AppData\Local\Temp\..\..\LocalLow\cmd.admin.bat
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
iscsicli.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\sfseunjd.exe

PID
3304
CMD
"C:\Users\admin\AppData\Local\Temp\sfseunjd.exe"
Path
C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\sfseunjd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\ole32.dll

PID
284
CMD
"C:\Windows\system32\sdbinst.exe" /q /u "C:\Users\admin\AppData\Local\Temp\\..\..\LocalLow\com.admin.sdb"
Path
C:\Windows\system32\sdbinst.exe
Indicators
No indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
Microsoft Corporation
Description
Application Compatibility Database Installer
Version
6.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\sdbinst.exe
c:\systemroot\system32\ntdll.dll

PID
2084
CMD
"C:\Windows\system32\sdbinst.exe" /q /u "C:\Users\admin\AppData\Local\Temp\\..\..\LocalLow\com.admin.sdb"
Path
C:\Windows\system32\sdbinst.exe
Indicators
Parent process
sfseunjd.exe
User
admin
Integrity Level
HIGH
Exit code
1
Version:
Company
Microsoft Corporation
Description
Application Compatibility Database Installer
Version
6.0.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\sdbinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
1212
CMD
"C:\Windows\system32\tracert.exe"
Path
C:\Windows\system32\tracert.exe
Indicators
Parent process
svchost.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
TCP/IP Traceroute Command
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\tracert.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\icmp.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shell32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\version.dll
c:\windows\system32\profapi.dll

PID
392
CMD
\??\C:\Windows\system32\conhost.exe
Path
C:\Windows\system32\conhost.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Console Window Host
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\tracert.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\profapi.dll

Registry activity

Total events
1897
Read events
1766
Write events
129
Delete events
2

Modification events

PID
Process
Operation
Key
Name
Value
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D100000000020000000000106600000001000020000000FA6D2DBA1939153F2EBD370C90F8E3422DC1220DB0BD6A2B350D2C48D9EBF52F000000000E80000000020000200000000D2EEA7A654BD9E9115F9A859FB1BB73F4AE3CF951A6F08B0698B927D2B2E9EAB000000095B524B7E8D20905CEB6F56DD709B34909D7BA3B1D580635FB595B847900ED2A18EC3C4BA9824D3D8516565A8A264CF25DEE830C76C555AF025BEC55A4F3FC4D5A8A3D639DBC355F36959AF287B374815FD510BF5B568577BEB1BD2708DC140C0713FF27786672905EC65E3EAC834555A0A5FEEABAF9547CCD0B4855C3613DC875F2E250997F1453B3B3A84E2A9EF7AA79E9A2F7FB6DD6DAC432E8113AE3A4F7EE4FBA8F930C73CAE9C19E867E872A23400000005BBD51B5A1EF4C1DB4253F9A3CA1503D24ED21446BD3161E4780B73C3E0CC70657C587CB8B0C87FD59CF691AFF056458A10B49FADF291762DC5B6997327774BF
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.106
CheckSetting
23004100430042006C006F00620000000000000001000000A000000000000000BA3041D25124D501000000007B00450038003400330033004200370032002D0035003800340032002D0034006400340033002D0038003600340035002D004200430032004300330035003900360030003800330037007D002E006E006F00740069006600690063006100740069006F006E002E003100300036002E0032002D00310032003900360035003400360000007200200032003000310030002E006C006E006B
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.101
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D1000000000200000000001066000000010000200000004E5D42AE614624CAEA82F9842F41E06EAADAEAFD8390FC36D6ED52C586FB2541000000000E80000000020000200000000E81743D418F08F95530A2730DDF18E9DE9DED99065A580C9B02FB3C38B34C2D30000000D23E3A6663A8A175FBFDABAE66B1BE52BEF88DDA36242CE179506526ECC3F506B91832983381E99F0BC375D6F474130040000000DCF5D1334FFCC697A886E54FB341264C3926EBAFC09A97714C32FDBB583FA1A68BEB7650F9D869A39CCD524B2ABC3556253B5901324FAAD167C85F2069326834
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.103
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D100000000020000000000106600000001000020000000E7A6CA35FE70A2F1EB797B7A686D67B00C05BE4E0AB0EC554040411C1A1183C2000000000E80000000020000200000005F0EC943038721012732710F895106273A7AB15B4F975DC7DB481D600731591C300000006B9F8FB28396AACC55DBD10342037D55ABE45C9F3776FC5383A4D320C756F74407B0D54927B6A1D607A60E1E0A8B336C400000009A77CD5E5385DC91AA428D063ACA688A9EEFCF53ED0DAA2CDA21E277C9E7CC020FB0C11C727CEC240D43DD176B88BBE4509B5AEEAE9135D83CC6EF8E23D41912
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D1000000000200000000001066000000010000200000001A686474C29A2AF44769DB0E3C8E1C4D00DE5E346F07762C612ACB0C8C2A0D02000000000E8000000002000020000000020EC5D42CFCFEEC466A89BEBC63586878F7C38225EA60853431CCBB438A883F30000000CC37403DEE7350DFFE501EFBF5B9EBAB9AB28E89E3B99784A12D36E26E6AB180A649DBD9DAF647C3C579A4607A0F808840000000F96786AF96443A1FBF8E47D585E7832FD58528EA184DE4B221EEB10DD1FF260D895ECD77274A19FCB3D0819396FC12B5660E1D8E680FF154CAC8AA9C8D3B8401
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D100000000020000000000106600000001000020000000D192E7BF1030ADA2B799C52EFE432D70F0C6B1025D81BB09A09F1D909C7DDEA0000000000E8000000002000020000000E45021ABE270EC5A7C0B5D37F5C9C86D6403F99A686FE7A5C7CDA69C5601F0143000000013889192581C4220EA71FBF9EDFE076CE2DD5F57694E48E1D8608A967CBB662AF5B1F16A2B925A870AB723DCE46D0E364000000011AD70A789CD657E28EC9CB1C1EEB4C5888ABC33898EADBF6649BCB841F26F77D1B8A14C7DD3A0B86E0CC71AF67992908ADA0D3C8FAF49557BC9D1E8DE8198EE
2044
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.104
CheckSetting
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000418795FC2F2C5A46852A5EA30B2A11D100000000020000000000106600000001000020000000BA6D91180E712F65E344B3F01895D8D06A08B4262C727D6FAF4FEA823160C742000000000E8000000002000020000000FC4F88A601583735B04EAC473493D1397826347E11A49996B2D223CE558B321030000000A486036180F38B5D618393BE2EF5A4EE577DA68CA7EA09D20E4292054ACA1232792B6770716A86CF79ADE5B310C678C74000000015E81BD0F7CBE61696F863ED85B29198D7FB5F0E9571AD3C1BABC413AD0EC67206940CA61014956414F3A97DAA26F621D6BFE181C48E84A01DF36B971C99685E
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
APPSTARTING
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
ARROW
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
CROSS
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
HAND
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
HELP
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
IBEAM
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
NO
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
SIZEALL
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
SIZENESW
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
SIZENS
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
SIZENWSE
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
SIZEWE
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
UPARROW
%SystemRoot%\cursors\clearcur.cur
556
windanr.exe
write
HKEY_CURRENT_USER\Control Panel\Cursors
WAIT
%SystemRoot%\cursors\clearcur.cur
3684
sfseunjd.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\iscsicli.exe
3684
sfseunjd.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f48a0c57-7c48-461c-9957-ab255ddc986e}
3684
sfseunjd.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3684
sfseunjd.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2620
svchost.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
JjbCnbda
C:\Users\admin\AppData\Local\bdjmdbtj\jjbcnbda.exe
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\iscsicli.exe
{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb
D6810BBE5124D501
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb
DisplayName
iscsicli
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb
UninstallString
%windir%\system32\sdbinst.exe -u "C:\Windows\AppPatch\Custom\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb"
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f48a0c57-7c48-461c-9957-ab255ddc986e}
DatabasePath
C:\Windows\AppPatch\Custom\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f48a0c57-7c48-461c-9957-ab255ddc986e}
DatabaseType
65536
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f48a0c57-7c48-461c-9957-ab255ddc986e}
DatabaseDescription
iscsicli
3988
sdbinst.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{f48a0c57-7c48-461c-9957-ab255ddc986e}
DatabaseInstallTimeStamp
D6810BBE5124D501
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
jfghdug_ooetvtgk
TRUE
3304
sfseunjd.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
SfsEunjd
C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
0
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UacDisableNotify
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wscsvc
Start
4
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
EnableFirewall
0
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
DoNotAllowExceptions
0
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
DisableNotifications
1
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc
Start
4
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend
Start
4
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv
Start
4
3304
sfseunjd.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
C:\Windows\system32\userinit.exe,,C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
1212
tracert.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\89726C36-545A-A301-A6CD-C8873A517CAB
Client
0000000000000000BCA45166545AA301A6CDC887DDC78EA900000000000000000000000000000000

Files activity

Executable files
2
Suspicious files
8
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
2836
2018-09-29_20-26-55.exe
C:\Users\admin\AppData\Local\Temp\sfseunjd.exe
executable
MD5: c51a0bfc921d6721e99a6d0fcae02d73
SHA256: ad45cfb13369d393156e9571f239ab9c58c43239067bbc74152d747d32bf3b0d
3684
sfseunjd.exe
C:\Users\admin\AppData\Local\Temp\alawsixx.exe
executable
MD5: c51a0bfc921d6721e99a6d0fcae02d73
SHA256: ad45cfb13369d393156e9571f239ab9c58c43239067bbc74152d747d32bf3b0d
3900
svchost.exe
C:\Users\admin\AppData\Local\fwdicmqp.log
compressed
MD5: 27e82c2a40adeab0d869624957315244
SHA256: 49e43a75638db1451c3e67d6ee1eeeb5a70d20f46e47433a05ce506053a22130
3900
svchost.exe
C:\Users\admin\AppData\Local\Temp\~TMAD1C.tmp
––
MD5:  ––
SHA256:  ––
3900
svchost.exe
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\cookies.txt
––
MD5:  ––
SHA256:  ––
3900
svchost.exe
C:\Users\admin\AppData\Local\ewnpecny.log
binary
MD5: 47cde3f34546edc38bfe59dde3b86819
SHA256: 0b556fe4be0cc7f641d2ea6fa90524daebeed603ca72f98e433e1dd63d8fc806
3900
svchost.exe
C:\Users\admin\AppData\Local\ewnpecny.log
binary
MD5: d9b46bb19db42a1522a78acafe616839
SHA256: c0c35579eddd13b574bfa2e03100eed049829adc2b3824891af4cc0f67e94c76
3900
svchost.exe
C:\Users\admin\AppData\Local\ewnpecny.log
binary
MD5: 3d66cea39c14a4d93b5893159a09e9d7
SHA256: ffdba0c546b9a66bd467dbe82982f137069357bcd27d0bbd19515a2256cce842
3988
sdbinst.exe
C:\Windows\AppPatch\Custom\{f48a0c57-7c48-461c-9957-ab255ddc986e}.sdb
sdb
MD5: 6e0bdb9e821a27bf740c98d6a60594bc
SHA256: 04176b2414414fcb81100fac2dd5d42bd8c50038f414a61714838d9387d8c1f1
2620
svchost.exe
C:\Users\admin\AppData\Local\dgjcifgy.log
binary
MD5: 32faf24ce588d59b11b7d3db32146c9b
SHA256: 5b01a0ad61a67b125c30ba2462ed4f1d7a8663136cbd8cde02721c83405eeb68
2620
svchost.exe
C:\ProgramData\qkoagtka.log
text
MD5: 0cfbf1f563d8566d1e80e041303374be
SHA256: 3f54059ba10cf9171491aee9104fea54d95889e6e534758da29a8d226ced3617
2620
svchost.exe
C:\Users\admin\AppData\Local\bdjmdbtj\jjbcnbda.exe
––
MD5:  ––
SHA256:  ––
2620
svchost.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jjbcnbda.exe
––
MD5:  ––
SHA256:  ––
3684
sfseunjd.exe
C:\Users\admin\AppData\LocalLow\com.admin.sdb
sdb
MD5: 6e0bdb9e821a27bf740c98d6a60594bc
SHA256: 04176b2414414fcb81100fac2dd5d42bd8c50038f414a61714838d9387d8c1f1
3684
sfseunjd.exe
C:\Users\admin\AppData\LocalLow\cmd.admin.bat
text
MD5: 2a76d0d35c661355f495127071d0b19b
SHA256: 7080a1a7cf4641ad4c721d26cf4caea51c4a992cc62e78009e6d33e38bb3e38b
3900
svchost.exe
C:\Users\admin\AppData\Local\kmypexkj.log
ini
MD5: 4ecacec5787c77deace45e111d29ffe7
SHA256: 4617ed574b0445bce05f49ba81b0075b57ee51e22666c683787ecaeaa936d59c
3900
svchost.exe
C:\Users\admin\AppData\Local\mfpmqwom.log
ini
MD5: 27d91e89937ba20ecf00126bb584ec55
SHA256: 057754f7e02cee326d8531f2c79261f75fdc510372f477a2fdb8779528078414

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
29
Threats
31

HTTP requests

No HTTP requests.

Connections

PID Process IP ASN CN Reputation
–– –– 172.217.21.238:80 Google Inc. US whitelisted
2620 svchost.exe 35.224.11.86:443 US malicious
2620 svchost.exe 92.63.97.30:443 JSC ISPsystem RU malicious

DNS requests

Domain IP Reputation
google.com 172.217.21.238
whitelisted
goldenfreeanhfirst.com No response malicious
lrjhjpmogfmrctmyqy.com No response unknown
gadqgqkdexwspxdc.com 35.224.11.86
malicious
wpmlwkual.com No response unknown
saolyfuyhuymmhd.com No response unknown
qhkyxycreoheacbh.com No response unknown
uacujgnkrqpmjiwfb.com No response unknown
xwicnpkgyxtafflkclv.com No response unknown
eoqtvdvtqtlsurfcot.com No response unknown
bjymkakljso.com No response unknown
tmnkqkuptre.com No response unknown
behksodpcricqtrlwma.com No response unknown
cjtxfjjnstlypt.com No response unknown
pdowncbc.com No response unknown
lifwbqygac.com No response unknown
ksxupjqvmmskcvdpqwt.com No response unknown
ylumtgcw.com No response unknown
ahxljfvcicfjpgd.com No response unknown
onqbwbcolbtnjld.com No response unknown
djonwelu.com No response unknown
eakbmmbn.com No response unknown
qscicbvbebepyjyd.com No response unknown
kekspnwsunybhdoyc.com No response unknown
rjoowoaetaqatin.com No response unknown
wrcfrbnyhomk.com No response unknown
jmwrboefbrhresaekn.com 92.63.97.30
malicious
upojrbjev.com No response unknown
tyuqrpfclg.com No response unknown

Threats

PID Process Class Message
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Banker Ramnit CnC Connection
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Banker Ramnit CnC Connection
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Banker Ramnit CnC Connection
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected ET TROJAN Win32/Ramnit Checkin
2620 svchost.exe A Network Trojan was detected MALWARE [PTsecurity] Banker Ramnit CnC Connection

Debug output strings

Process Message
svchost.exe [VNCDLL][:3900][ImgMapSection:30] A section of 0 bytes mapped to the target process at 0x003B0000
svchost.exe [VNCDLL][:3900][ImgMapSection:30] A section of 0 bytes mapped to the target process at 0x003B0000
svchost.exe [VNCDLL][:3900][ImgMapSection:30] A section of 0 bytes mapped to the target process at 0x003B0000
svchost.exe [VNCDLL][:3900][ImgMapSection:30] A section of 0 bytes mapped to the target process at 0x003B0000