7fcf0ff8696a53975d5a5fba95ca377183ef5e693907fabac84c72d12146d29a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12dd161b41121cexeexeexeex.exe
Size

192KB
MD5

12dd161b41121c609c66982c71803660
SHA1

4e19aaea34258c7d08b1699558a2f6ae6d00b923
SHA256

7fcf0ff8696a53975d5a5fba95ca377183ef5e693907fabac84c72d12146d29a
SHA512

d9cf01d21e95d40a29bf9416a692f0e6c04c0c2c6578b331321dae909f5aa1141cda7ca43df697aaee69ea235ab83920cfb60dcb9eb7d89cdb259ef2b6e0b261
SSDEEP

1536:1EGh0ocl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0ocl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45460722-7977-4084-BFF9-A371B1DDDF25}\stubpath = "C:\\Windows\\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe"	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71DE35D1-D930-4eda-9193-5F1177563CDF}\stubpath = "C:\\Windows\\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe"	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80C14393-9E5B-4ce0-9D4E-5520BA820737}	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F84DE55C-F8CC-4cf6-90B3-F60081987993}	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F84DE55C-F8CC-4cf6-90B3-F60081987993}\stubpath = "C:\\Windows\\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe"	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{457F3132-D19E-461a-9E73-97F0AF7A1985}	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25E1B1B3-A895-4df7-989D-A83E42E405F7}	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45460722-7977-4084-BFF9-A371B1DDDF25}	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF469B65-1C65-4ffd-809F-73DB9D17D297}	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF469B65-1C65-4ffd-809F-73DB9D17D297}\stubpath = "C:\\Windows\\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe"	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{457F3132-D19E-461a-9E73-97F0AF7A1985}\stubpath = "C:\\Windows\\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe"	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25E1B1B3-A895-4df7-989D-A83E42E405F7}\stubpath = "C:\\Windows\\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe"	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71DE35D1-D930-4eda-9193-5F1177563CDF}	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}	12dd161b41121cexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}\stubpath = "C:\\Windows\\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe"	12dd161b41121cexeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}\stubpath = "C:\\Windows\\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe"	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}\stubpath = "C:\\Windows\\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe"	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}	{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}\stubpath = "C:\\Windows\\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe"	{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}\stubpath = "C:\\Windows\\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe"	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80C14393-9E5B-4ce0-9D4E-5520BA820737}\stubpath = "C:\\Windows\\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe"	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe

Executes dropped EXE 12 IoCs

pid	Process
3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
3192	{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
472	{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
File created	C:\Windows\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
File created	C:\Windows\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
File created	C:\Windows\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
File created	C:\Windows\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	12dd161b41121cexeexeexeex.exe
File created	C:\Windows\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
File created	C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
File created	C:\Windows\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
File created	C:\Windows\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe	{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
File created	C:\Windows\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
File created	C:\Windows\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
File created	C:\Windows\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1656	12dd161b41121cexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
Token: SeIncBasePriorityPrivilege	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
Token: SeIncBasePriorityPrivilege	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
Token: SeIncBasePriorityPrivilege	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
Token: SeIncBasePriorityPrivilege	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
Token: SeIncBasePriorityPrivilege	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
Token: SeIncBasePriorityPrivilege	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
Token: SeIncBasePriorityPrivilege	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
Token: SeIncBasePriorityPrivilege	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
Token: SeIncBasePriorityPrivilege	4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
Token: SeIncBasePriorityPrivilege	3192	{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3748	1656	12dd161b41121cexeexeexeex.exe	89
PID 1656 wrote to memory of 3748	1656	12dd161b41121cexeexeexeex.exe	89
PID 1656 wrote to memory of 3748	1656	12dd161b41121cexeexeexeex.exe	89
PID 1656 wrote to memory of 4732	1656	12dd161b41121cexeexeexeex.exe	90
PID 1656 wrote to memory of 4732	1656	12dd161b41121cexeexeexeex.exe	90
PID 1656 wrote to memory of 4732	1656	12dd161b41121cexeexeexeex.exe	90
PID 3748 wrote to memory of 4576	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	91
PID 3748 wrote to memory of 4576	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	91
PID 3748 wrote to memory of 4576	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	91
PID 3748 wrote to memory of 1384	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	92
PID 3748 wrote to memory of 1384	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	92
PID 3748 wrote to memory of 1384	3748	{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe	92
PID 4576 wrote to memory of 4564	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	96
PID 4576 wrote to memory of 4564	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	96
PID 4576 wrote to memory of 4564	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	96
PID 4576 wrote to memory of 3984	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	97
PID 4576 wrote to memory of 3984	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	97
PID 4576 wrote to memory of 3984	4576	{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe	97
PID 4564 wrote to memory of 3220	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	98
PID 4564 wrote to memory of 3220	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	98
PID 4564 wrote to memory of 3220	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	98
PID 4564 wrote to memory of 2620	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	99
PID 4564 wrote to memory of 2620	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	99
PID 4564 wrote to memory of 2620	4564	{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe	99
PID 3220 wrote to memory of 5024	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	100
PID 3220 wrote to memory of 5024	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	100
PID 3220 wrote to memory of 5024	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	100
PID 3220 wrote to memory of 4136	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	101
PID 3220 wrote to memory of 4136	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	101
PID 3220 wrote to memory of 4136	3220	{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe	101
PID 5024 wrote to memory of 2280	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	102
PID 5024 wrote to memory of 2280	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	102
PID 5024 wrote to memory of 2280	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	102
PID 5024 wrote to memory of 1792	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	103
PID 5024 wrote to memory of 1792	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	103
PID 5024 wrote to memory of 1792	5024	{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe	103
PID 2280 wrote to memory of 1340	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	104
PID 2280 wrote to memory of 1340	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	104
PID 2280 wrote to memory of 1340	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	104
PID 2280 wrote to memory of 2360	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	105
PID 2280 wrote to memory of 2360	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	105
PID 2280 wrote to memory of 2360	2280	{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe	105
PID 1340 wrote to memory of 3364	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	106
PID 1340 wrote to memory of 3364	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	106
PID 1340 wrote to memory of 3364	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	106
PID 1340 wrote to memory of 4408	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	107
PID 1340 wrote to memory of 4408	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	107
PID 1340 wrote to memory of 4408	1340	{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe	107
PID 3364 wrote to memory of 1480	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	108
PID 3364 wrote to memory of 1480	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	108
PID 3364 wrote to memory of 1480	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	108
PID 3364 wrote to memory of 1992	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	109
PID 3364 wrote to memory of 1992	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	109
PID 3364 wrote to memory of 1992	3364	{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe	109
PID 1480 wrote to memory of 4680	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	110
PID 1480 wrote to memory of 4680	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	110
PID 1480 wrote to memory of 4680	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	110
PID 1480 wrote to memory of 5028	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	111
PID 1480 wrote to memory of 5028	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	111
PID 1480 wrote to memory of 5028	1480	{45460722-7977-4084-BFF9-A371B1DDDF25}.exe	111
PID 4680 wrote to memory of 3192	4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe	112
PID 4680 wrote to memory of 3192	4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe	112
PID 4680 wrote to memory of 3192	4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe	112
PID 4680 wrote to memory of 1284	4680	{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe	113

C:\Users\Admin\AppData\Local\Temp\12dd161b41121cexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\12dd161b41121cexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
  C:\Windows\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
    C:\Windows\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
      C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
        
        C:\Windows\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
        
        C:\Windows\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
        
        C:\Windows\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
        
        C:\Windows\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
        
        C:\Windows\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
        
        C:\Windows\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
        
        C:\Windows\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
        
        C:\Windows\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
        
        C:\Windows\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe
        
        C:\Windows\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe
        13⤵
        Executes dropped EXE
        
        PID:472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71DE3~1.EXE > nul
        13⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C4EAF~1.EXE > nul
        12⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45460~1.EXE > nul
        11⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{25E1B~1.EXE > nul
        10⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{457F3~1.EXE > nul
        9⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EF77~1.EXE > nul
        8⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F84DE~1.EXE > nul
        7⤵
        
        PID:1792
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{80C14~1.EXE > nul
        6⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{38AB4~1.EXE > nul
        5⤵
        
        PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DF469~1.EXE > nul
      4⤵
      PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F9B27~1.EXE > nul
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\12DD16~1.EXE > nul
  2⤵
  PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe

Filesize
192KB

MD5
a739480686e8b2f2f05e889c6d443ef7

SHA1
fad3ac95b99783440a732ff3ae2d92bf84fd393b

SHA256
e4833756e84f62ed055ecc47beddd54c0539ce54c464ff611d536b8128143bd0

SHA512
d5c29de9afa790a8f9cc002553fe5c326b14e1dfed3c660e1f08b277a057aaf5a4ea63a4306da6cc3decb04167db16d0dab49749792ec78cfbed2bd39d0024f5

Download Submit
C:\Windows\{25E1B1B3-A895-4df7-989D-A83E42E405F7}.exe

Filesize
192KB

MD5
a739480686e8b2f2f05e889c6d443ef7

SHA1
fad3ac95b99783440a732ff3ae2d92bf84fd393b

SHA256
e4833756e84f62ed055ecc47beddd54c0539ce54c464ff611d536b8128143bd0

SHA512
d5c29de9afa790a8f9cc002553fe5c326b14e1dfed3c660e1f08b277a057aaf5a4ea63a4306da6cc3decb04167db16d0dab49749792ec78cfbed2bd39d0024f5

Download Submit
C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe

Filesize
192KB

MD5
27934ce97f1454626ca59af4fc8595cf

SHA1
96d6b6e2a3f7fdb11c3943abcb8d2f9ac5adacf3

SHA256
045c9af8c519399a245833a13821d97b87004a796a52300888511334cb1c0260

SHA512
1a6510067cad8a61bd04f39f8773700f0216ff1ef6caaec3dbeb055567972558b09684db1b37a7ec35d22eff05eee40131d66a8214bc61c8c4eafa775170b649

Download Submit
C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe

Filesize
192KB

MD5
27934ce97f1454626ca59af4fc8595cf

SHA1
96d6b6e2a3f7fdb11c3943abcb8d2f9ac5adacf3

SHA256
045c9af8c519399a245833a13821d97b87004a796a52300888511334cb1c0260

SHA512
1a6510067cad8a61bd04f39f8773700f0216ff1ef6caaec3dbeb055567972558b09684db1b37a7ec35d22eff05eee40131d66a8214bc61c8c4eafa775170b649

Download Submit
C:\Windows\{38AB4010-9F07-444c-AA7F-9F57FEAC97D4}.exe

Filesize
192KB

MD5
27934ce97f1454626ca59af4fc8595cf

SHA1
96d6b6e2a3f7fdb11c3943abcb8d2f9ac5adacf3

SHA256
045c9af8c519399a245833a13821d97b87004a796a52300888511334cb1c0260

SHA512
1a6510067cad8a61bd04f39f8773700f0216ff1ef6caaec3dbeb055567972558b09684db1b37a7ec35d22eff05eee40131d66a8214bc61c8c4eafa775170b649

Download Submit
C:\Windows\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe

Filesize
192KB

MD5
b946a86383aa4afb0433a7cb40908bf6

SHA1
c8413b37a44c19eff0981a19b2c28f52a644c797

SHA256
bce39e579decfae481308b2a0e356b791e56a89647301986dbcb1c8e90a5dd77

SHA512
8969a14c9b68bcdb3ae43b72466e1f0d80b46f911b234bffa5d3f836e38075f2c365b0b4b8b92c0a579e728357e6b8f9ca1996247de53cce48acfdbc73a8cc18

Download Submit
C:\Windows\{45460722-7977-4084-BFF9-A371B1DDDF25}.exe

Filesize
192KB

MD5
b946a86383aa4afb0433a7cb40908bf6

SHA1
c8413b37a44c19eff0981a19b2c28f52a644c797

SHA256
bce39e579decfae481308b2a0e356b791e56a89647301986dbcb1c8e90a5dd77

SHA512
8969a14c9b68bcdb3ae43b72466e1f0d80b46f911b234bffa5d3f836e38075f2c365b0b4b8b92c0a579e728357e6b8f9ca1996247de53cce48acfdbc73a8cc18

Download Submit
C:\Windows\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe

Filesize
192KB

MD5
676517dee43a00999eb3933ff0642c5d

SHA1
cdfbc064ef640ed34165b1c25b4473dd911a11b7

SHA256
49caf07b5eef9bf7b71ecff9211962c064e1d934606777bf980b8561ae5b1b78

SHA512
02681f3152ed2a017ef75930796a8db16c8a64072ac17b12d5a768269736a0bc5c19149962c5162878eed2266c5039d644207bd01391bf690a9cc8de67815ac6

Download Submit
C:\Windows\{457F3132-D19E-461a-9E73-97F0AF7A1985}.exe

Filesize
192KB

MD5
676517dee43a00999eb3933ff0642c5d

SHA1
cdfbc064ef640ed34165b1c25b4473dd911a11b7

SHA256
49caf07b5eef9bf7b71ecff9211962c064e1d934606777bf980b8561ae5b1b78

SHA512
02681f3152ed2a017ef75930796a8db16c8a64072ac17b12d5a768269736a0bc5c19149962c5162878eed2266c5039d644207bd01391bf690a9cc8de67815ac6

Download Submit
C:\Windows\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe

Filesize
192KB

MD5
c38816571800be90d630b51e3361e027

SHA1
5ba623e4c849d097c9165f7a83b7211ab99f33ea

SHA256
c46bcfc91c71d6b3886504a5e490bb4f4746257c0a9a6448594cc410f1dd3c6a

SHA512
8109c4ca984b86c14feb524608235d8aabdb8d641a9c4ba4abc0d48fc93d58547e3691b75f524c6369a52b32643dc27faa83ec32160c9d770c13172abaef4a93

Download Submit
C:\Windows\{6EF77DA6-5307-4884-B91C-8CC3E48F6BDE}.exe

Filesize
192KB

MD5
c38816571800be90d630b51e3361e027

SHA1
5ba623e4c849d097c9165f7a83b7211ab99f33ea

SHA256
c46bcfc91c71d6b3886504a5e490bb4f4746257c0a9a6448594cc410f1dd3c6a

SHA512
8109c4ca984b86c14feb524608235d8aabdb8d641a9c4ba4abc0d48fc93d58547e3691b75f524c6369a52b32643dc27faa83ec32160c9d770c13172abaef4a93

Download Submit
C:\Windows\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe

Filesize
192KB

MD5
23446ff1a98b106c35601e352d6a55bb

SHA1
050b144dab0a7d82f3cf20c92599df0e4172a055

SHA256
0b0276710a762434f040c37c511f28bf825ccc79a12bbcd3efa8af3ef0ac6f30

SHA512
2e677e25b1f3937a2581de87c9f4eb44ae1812506a3594660b4dded22d954463920d03238a3ae6a8560f502929cdd8253d95df072369c1991ac029b615deac2c

Download Submit
C:\Windows\{71DE35D1-D930-4eda-9193-5F1177563CDF}.exe

Filesize
192KB

MD5
23446ff1a98b106c35601e352d6a55bb

SHA1
050b144dab0a7d82f3cf20c92599df0e4172a055

SHA256
0b0276710a762434f040c37c511f28bf825ccc79a12bbcd3efa8af3ef0ac6f30

SHA512
2e677e25b1f3937a2581de87c9f4eb44ae1812506a3594660b4dded22d954463920d03238a3ae6a8560f502929cdd8253d95df072369c1991ac029b615deac2c

Download Submit
C:\Windows\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe

Filesize
192KB

MD5
aeb20cdee56b6f8c4f0b4aa70ff8211d

SHA1
afc3f16c81c65080020f3b595c4d31c04ee83ea6

SHA256
eee55c1a9a816da85a2789383340787f28e558a51835a7fbad04fcec0773a790

SHA512
36474792a07f265e30933830f840206e6089192036a52b04ad4145861e952913c62a4f73311d6025d24f5e8441cea53bc949c462ee89bd54b07e075f72d40cfc

Download Submit
C:\Windows\{80C14393-9E5B-4ce0-9D4E-5520BA820737}.exe

Filesize
192KB

MD5
aeb20cdee56b6f8c4f0b4aa70ff8211d

SHA1
afc3f16c81c65080020f3b595c4d31c04ee83ea6

SHA256
eee55c1a9a816da85a2789383340787f28e558a51835a7fbad04fcec0773a790

SHA512
36474792a07f265e30933830f840206e6089192036a52b04ad4145861e952913c62a4f73311d6025d24f5e8441cea53bc949c462ee89bd54b07e075f72d40cfc

Download Submit
C:\Windows\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe

Filesize
192KB

MD5
f93bffaeaf2f1c67b79b8c4d8c209989

SHA1
3a534e2b27cb94b41d50ee0e5a952fdcc01e835a

SHA256
8fa1243dda01fb6e0112acfded67852239f5094d95c5bb5687befa542176f2e8

SHA512
ed9942043d7232d44edb62e8bd0bf7afcef3e8bff6bcfd591e5a269e12c0035c2e42d064ca9568c8ce748d9ed159130dc133fa0d346b2e3789b5ecc94dac2db2

Download Submit
C:\Windows\{C4EAF4F2-D53C-48e8-B7D4-634606273AFB}.exe

Filesize
192KB

MD5
f93bffaeaf2f1c67b79b8c4d8c209989

SHA1
3a534e2b27cb94b41d50ee0e5a952fdcc01e835a

SHA256
8fa1243dda01fb6e0112acfded67852239f5094d95c5bb5687befa542176f2e8

SHA512
ed9942043d7232d44edb62e8bd0bf7afcef3e8bff6bcfd591e5a269e12c0035c2e42d064ca9568c8ce748d9ed159130dc133fa0d346b2e3789b5ecc94dac2db2

Download Submit
C:\Windows\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe

Filesize
192KB

MD5
7822bc1ba5f184c75ab21a3c2f225b3c

SHA1
788e9e61d22346647b741ace78688bec60534b3a

SHA256
2680c72ed2300f780fd4fe1883e7d4ed9ba4cf165178d7584fdb0c094a968c71

SHA512
e46efd89dfdadee63be5bc82c124723281d244c3479913bd74c8b3dfe0423fcf1b6e31952dc40bc8743acba5542714a0e8ae16c1c7e9e7323ffe011ce4d7637e

Download Submit
C:\Windows\{DF469B65-1C65-4ffd-809F-73DB9D17D297}.exe

Filesize
192KB

MD5
7822bc1ba5f184c75ab21a3c2f225b3c

SHA1
788e9e61d22346647b741ace78688bec60534b3a

SHA256
2680c72ed2300f780fd4fe1883e7d4ed9ba4cf165178d7584fdb0c094a968c71

SHA512
e46efd89dfdadee63be5bc82c124723281d244c3479913bd74c8b3dfe0423fcf1b6e31952dc40bc8743acba5542714a0e8ae16c1c7e9e7323ffe011ce4d7637e

Download Submit
C:\Windows\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe

Filesize
192KB

MD5
1f4f4e51f8fe1ed086a096826d32778f

SHA1
8fdc1a32a261d57f016b0fc2a77c7124273d2857

SHA256
6a6e603d11575b58f1d631d38132825232c77eee7931c45f1ab281c12cade887

SHA512
333b43465ccd77197ca2fb3c585d347ff1a003bc350c392db9f2c7e807da9d9231d5c8609b62723d675f84f361406f565cf630056ace2275bd1e992f06a99aa2

Download Submit
C:\Windows\{EDE6A05B-4F00-47d5-8E1B-D5070E921F94}.exe

Filesize
192KB

MD5
1f4f4e51f8fe1ed086a096826d32778f

SHA1
8fdc1a32a261d57f016b0fc2a77c7124273d2857

SHA256
6a6e603d11575b58f1d631d38132825232c77eee7931c45f1ab281c12cade887

SHA512
333b43465ccd77197ca2fb3c585d347ff1a003bc350c392db9f2c7e807da9d9231d5c8609b62723d675f84f361406f565cf630056ace2275bd1e992f06a99aa2

Download Submit
C:\Windows\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe

Filesize
192KB

MD5
33e9494a139d5ca5065f4a6d57fbcd3b

SHA1
54ddbea2dc987aa033ea1c3e49009c6003488d2d

SHA256
267611ddb4aa36ad96677becb421e12b4ba74f0bc80bb1dd388f1b09e61f01d6

SHA512
0245de9f72722380e0b0381318e85ac0b63216fd4261c1fd0ad042aab8c70f7f5215aa2cf0734e932d59ae7ee9174ecea1cd3824abb721179014d60c19c03b30

Download Submit
C:\Windows\{F84DE55C-F8CC-4cf6-90B3-F60081987993}.exe

Filesize
192KB

MD5
33e9494a139d5ca5065f4a6d57fbcd3b

SHA1
54ddbea2dc987aa033ea1c3e49009c6003488d2d

SHA256
267611ddb4aa36ad96677becb421e12b4ba74f0bc80bb1dd388f1b09e61f01d6

SHA512
0245de9f72722380e0b0381318e85ac0b63216fd4261c1fd0ad042aab8c70f7f5215aa2cf0734e932d59ae7ee9174ecea1cd3824abb721179014d60c19c03b30

Download Submit
C:\Windows\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe

Filesize
192KB

MD5
3911cafa7f4d0a7e58f7bc2bb08af89a

SHA1
e156b1a3031f16e899b5a05f959d23c9206d1c99

SHA256
dfd549d147e8b79bc107be38041c4f00f4596caef93f9f6e59d04f955417e11c

SHA512
ec6bdcb5d65e6b4dbe2686a2aea4df66db78979d65ac6a9cfc77173785e82a395dcc932394b5fe2300297228bb24328dc00c7fe2d10054324c3ed2c981b2a87a

Download Submit
C:\Windows\{F9B271D9-EF73-4ba3-AC7A-A334542FD396}.exe

Filesize
192KB

MD5
3911cafa7f4d0a7e58f7bc2bb08af89a

SHA1
e156b1a3031f16e899b5a05f959d23c9206d1c99

SHA256
dfd549d147e8b79bc107be38041c4f00f4596caef93f9f6e59d04f955417e11c

SHA512
ec6bdcb5d65e6b4dbe2686a2aea4df66db78979d65ac6a9cfc77173785e82a395dcc932394b5fe2300297228bb24328dc00c7fe2d10054324c3ed2c981b2a87a

Download Submit