FA0978B3D14458524BB235D6095358A27AF9F2E9281BE7CD0EB1A4D2123A8330

MALICIOUS

• Starts NET.EXE to view/change users group

  • cmd.exe (PID: 2224)
  • cmd.exe (PID: 1300)

• Loads dropped or rewritten executable

  • update.exe (PID: 2564)
  • WMIC.exe (PID: 2920)

• Uses Task Scheduler to run other applications

  • cmd.exe (PID: 7576)

• Loads the Task Scheduler COM API

  • schtasks.exe (PID: 8132)
  • schtasks.exe (PID: 8676)
  • schtasks.exe (PID: 8368)

SUSPICIOUS

• Loads Python modules

  • update.exe (PID: 2564)

• Executable content was dropped or overwritten

  • update.exe (PID: 644)
  • cmd.exe (PID: 7576)

• Executes PowerShell scripts

  • update.exe (PID: 2564)

• Starts CMD.EXE for commands execution

  • update.exe (PID: 2564)
  • EHhmiMhS.exe (PID: 5608)
  • WScript.exe (PID: 2960)

• Creates files in the user directory

  • powershell.exe (PID: 3620)

• Uses IPCONFIG.EXE to discover IP address

  • cmd.exe (PID: 2844)
  • update.exe (PID: 2564)

• Uses NETSTAT.EXE to discover network connections

  • update.exe (PID: 2564)

• Executes scripts

  • cmd.exe (PID: 6352)

• Uses NETSH.EXE for network configuration

  • cmd.exe (PID: 7576)

• Creates files in the Windows directory

  • cmd.exe (PID: 7576)

INFO