FA0978B3D14458524BB235D6095358A27AF9F2E9281BE7CD0EB1A4D2123A8330

MALICIOUS

• Loads dropped or rewritten executable

  • update.exe (PID: 952)
  • WMIC.exe (PID: 2488)

• Starts NET.EXE to view/change users group

  • cmd.exe (PID: 3528)
  • cmd.exe (PID: 3252)

• Loads the Task Scheduler COM API

  • schtasks.exe (PID: 8852)
  • schtasks.exe (PID: 8500)
  • schtasks.exe (PID: 8752)

• Uses Task Scheduler to run other applications

  • cmd.exe (PID: 7660)

SUSPICIOUS

• Executable content was dropped or overwritten

  • update.exe (PID: 2116)
  • cmd.exe (PID: 7660)

• Executes PowerShell scripts

  • update.exe (PID: 952)

• Loads Python modules

  • update.exe (PID: 952)

• Creates files in the user directory

  • powershell.exe (PID: 692)

• Starts CMD.EXE for commands execution

  • update.exe (PID: 952)
  • WScript.exe (PID: 7728)
  • mybwQHWJ.exe (PID: 5464)

• Uses IPCONFIG.EXE to discover IP address

  • cmd.exe (PID: 2172)
  • update.exe (PID: 952)

• Executes scripts

  • cmd.exe (PID: 6612)

• Creates files in the Windows directory

  • cmd.exe (PID: 7660)

• Uses NETSTAT.EXE to discover network connections

  • update.exe (PID: 952)

• Uses NETSH.EXE for network configuration

  • cmd.exe (PID: 7660)

INFO