c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

Analysis

max time kernel
146s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
Size

72KB
MD5

21d9b309aedff51fc743a5ff78092144
SHA1

5bb3979aef3e59aea1c8ae2396054060b849d943
SHA256

c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c
SHA512

0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa
SSDEEP

1536:/yqrQrFUH+HtWXiaAkc//////4KCCai/iZ72rHp/pOiqms1zLaqO+:BqOHjyAc//////jCCLi+Jz1Gaq1

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1912	hnetcfg.exe
1468	hnetcfg.exe
108	hnetcfg.exe
824	hnetcfg.exe
1920	hnetcfg.exe
1776	hnetcfg.exe
524	hnetcfg.exe
292	hnetcfg.exe

Modifies Installed Components in the registry 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}\StubPath = "C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\hnetcfg.exe /i"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}	reg.exe

Deletes itself 1 IoCs

pid	Process
268	cmd.exe

Loads dropped DLL 8 IoCs

pid	Process
1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
1912	hnetcfg.exe
1468	hnetcfg.exe
108	hnetcfg.exe
824	hnetcfg.exe
1920	hnetcfg.exe
1776	hnetcfg.exe
524	hnetcfg.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hnetcfg.exe	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
File opened for modification	C:\Windows\SysWOW64\hnetcfg.exe	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
File created	C:\Windows\SysWOW64\_deleteme.bat	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\c_l9183.nls	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe
File created	C:\Windows\SysWOW64\_Setup.bat	hnetcfg.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
1912	hnetcfg.exe
1468	hnetcfg.exe
108	hnetcfg.exe
824	hnetcfg.exe
1920	hnetcfg.exe
1776	hnetcfg.exe
524	hnetcfg.exe
292	hnetcfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1352 wrote to memory of 1284	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	28
PID 1284 wrote to memory of 732	1284	cmd.exe	30
PID 1284 wrote to memory of 732	1284	cmd.exe	30
PID 1284 wrote to memory of 732	1284	cmd.exe	30
PID 1284 wrote to memory of 732	1284	cmd.exe	30
PID 1284 wrote to memory of 624	1284	cmd.exe	31
PID 1284 wrote to memory of 624	1284	cmd.exe	31
PID 1284 wrote to memory of 624	1284	cmd.exe	31
PID 1284 wrote to memory of 624	1284	cmd.exe	31
PID 1352 wrote to memory of 268	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	32
PID 1352 wrote to memory of 268	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	32
PID 1352 wrote to memory of 268	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	32
PID 1352 wrote to memory of 268	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	32
PID 1352 wrote to memory of 1912	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	34
PID 1352 wrote to memory of 1912	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	34
PID 1352 wrote to memory of 1912	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	34
PID 1352 wrote to memory of 1912	1352	c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe	34
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 1912 wrote to memory of 2012	1912	hnetcfg.exe	35
PID 2012 wrote to memory of 900	2012	cmd.exe	37
PID 2012 wrote to memory of 900	2012	cmd.exe	37
PID 2012 wrote to memory of 900	2012	cmd.exe	37
PID 2012 wrote to memory of 900	2012	cmd.exe	37
PID 2012 wrote to memory of 1716	2012	cmd.exe	38
PID 2012 wrote to memory of 1716	2012	cmd.exe	38
PID 2012 wrote to memory of 1716	2012	cmd.exe	38
PID 2012 wrote to memory of 1716	2012	cmd.exe	38
PID 1912 wrote to memory of 1468	1912	hnetcfg.exe	39
PID 1912 wrote to memory of 1468	1912	hnetcfg.exe	39
PID 1912 wrote to memory of 1468	1912	hnetcfg.exe	39
PID 1912 wrote to memory of 1468	1912	hnetcfg.exe	39
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1468 wrote to memory of 1176	1468	hnetcfg.exe	40
PID 1176 wrote to memory of 1052	1176	cmd.exe	42
PID 1176 wrote to memory of 1052	1176	cmd.exe	42
PID 1176 wrote to memory of 1052	1176	cmd.exe	42
PID 1176 wrote to memory of 1052	1176	cmd.exe	42
PID 1176 wrote to memory of 684	1176	cmd.exe	43
PID 1176 wrote to memory of 684	1176	cmd.exe	43
PID 1176 wrote to memory of 684	1176	cmd.exe	43
PID 1176 wrote to memory of 684	1176	cmd.exe	43
PID 1468 wrote to memory of 108	1468	hnetcfg.exe	44
PID 1468 wrote to memory of 108	1468	hnetcfg.exe	44
PID 1468 wrote to memory of 108	1468	hnetcfg.exe	44
PID 1468 wrote to memory of 108	1468	hnetcfg.exe	44
PID 108 wrote to memory of 1860	108	hnetcfg.exe	45
PID 108 wrote to memory of 1860	108	hnetcfg.exe	45
PID 108 wrote to memory of 1860	108	hnetcfg.exe	45

C:\Users\Admin\AppData\Local\Temp\c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe
"C:\Users\Admin\AppData\Local\Temp\c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\_Setup.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
    3⤵
    - Modifies Installed Components in the registry
    PID:732
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
    3⤵
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\_deleteme.bat
  2⤵
  - Deletes itself
  PID:268
- C:\Windows\SysWOW64\hnetcfg.exe
  C:\Windows\system32\hnetcfg.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\system32\_Setup.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
      4⤵
      Modifies Installed Components in the registry
      PID:900
  - - C:\Windows\SysWOW64\reg.exe
      reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
      4⤵
      PID:1716
- - C:\Windows\SysWOW64\hnetcfg.exe
    C:\Windows\system32\hnetcfg.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\_Setup.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        5⤵
        Modifies Installed Components in the registry
        
        PID:1052
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        5⤵
        
        PID:684
  - - C:\Windows\SysWOW64\hnetcfg.exe
      C:\Windows\system32\hnetcfg.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:108
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        5⤵
        
        PID:1860
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        6⤵
        Modifies Installed Components in the registry
        
        PID:1792
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        6⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\hnetcfg.exe
        
        C:\Windows\system32\hnetcfg.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:824
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        6⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        7⤵
        Modifies Installed Components in the registry
        
        PID:1508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        7⤵
        
        PID:984
      - C:\Windows\SysWOW64\hnetcfg.exe
        
        C:\Windows\system32\hnetcfg.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        7⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        8⤵
        Modifies Installed Components in the registry
        
        PID:1924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\hnetcfg.exe
        
        C:\Windows\system32\hnetcfg.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        8⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        9⤵
        Modifies Installed Components in the registry
        
        PID:1068
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        9⤵
        
        PID:320
        
        C:\Windows\SysWOW64\hnetcfg.exe
        
        C:\Windows\system32\hnetcfg.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        9⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        10⤵
        Modifies Installed Components in the registry
        
        PID:1612
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        10⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\hnetcfg.exe
        
        C:\Windows\system32\hnetcfg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\_Setup.bat
        10⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /v StubPath /t REG_SZ /d "C:\Windows\system32\cmd.exe /c C:\Windows\system32\hnetcfg.exe /i" /f
        11⤵
        Modifies Installed Components in the registry
        
        PID:888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{770JVE14-MKX7-2I75-D22G-E7RI6FRP4877}" /f
        11⤵
        
        PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_Setup.bat

Filesize
353B

MD5
a083cc892f542fca60e3009f70b2cb9d

SHA1
64343059bb782f7d4eacfd3ecfb1ebf7af88e442

SHA256
1fd1c2e3fd2ad6bc12c2732d3f43e4e50800e9a8ad1106dfbc6b4ae7839894ed

SHA512
26aa09d12f141dbad0d67d5db38bc9d9ffb7f5d04634dc5656ad1b3083c4e024ec3c05c2c0fd635d7147ffcddae8fbe78902765a8870392f68afbc0e66438309

Download Submit
C:\Windows\SysWOW64\_deleteme.bat

Filesize
248B

MD5
84d5b3958f9f9f040f0f9654761c1901

SHA1
5a5464c20f31b250495088c9b755c37341fe60d3

SHA256
0fc1295242fc6ec8f68aebb8f0cbe1b0b95b65afea6f9bc8808a3d73a3e77b48

SHA512
1b589ab09ceeb4cbde91221c04678af0dce7c20ca496191d635eb3cba138ad6ef77337160631046acfd07d210424cfcd7da0df5be909b46b41f94aa689c5cf6b

Download Submit
C:\Windows\SysWOW64\c_l9183.nls

Filesize
914B

MD5
770af84abed5c3c1ac9a9b0552f4fb68

SHA1
4e41f1025eb6382cd6e681d41a62fee25eeac16f

SHA256
3d9ddd70dd8ad3a58e6c4d361fc74b54503091d82cd9fdf3343a5b067ba37b2e

SHA512
4853256e118fabeb9a0bcd944576c4165819c985997883fe3f2065e186fbf581de253ab4ae6b55b0078654f9a09d3605bc0bd57571a571a906271eb0463549ac

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
C:\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit
\Windows\SysWOW64\hnetcfg.exe

Filesize
72KB

MD5
21d9b309aedff51fc743a5ff78092144

SHA1
5bb3979aef3e59aea1c8ae2396054060b849d943

SHA256
c8466cdd4daa4c5df824b2788fa7d820429dd19dadcb1e49e577fd1501a7179c

SHA512
0837acd733526badc902dc3697c532322475532f28f55172ee6f87e8314bf2c81f4c3c0bfe42838c8c528166effe38f486baaa9804a8b0e7d85abc9f1fb583fa

Download Submit