f66ffe9563e0208901a5d3da3d990f5f0c96ddc970920329b45effed7847c192

Analysis

max time kernel
150s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4104a3469da45fexeexeexeex.exe
Size

204KB
MD5

4104a3469da45fb0020ebbbd6eab7b0a
SHA1

4db8f05d3d496ad2c3f9ea3370af69e6a981913b
SHA256

f66ffe9563e0208901a5d3da3d990f5f0c96ddc970920329b45effed7847c192
SHA512

571ca9118c978cb6953fe2795b3fc8ef052bd50d82273eb63c21b7184785531c369beb3c2e46a4eb724f424cd89a98e6b4e7c163fb3952ba51139965722e003a
SSDEEP

1536:1EGh0oxYl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oCl1OPOe2MUVg3Ve+rXfMUy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}\stubpath = "C:\\Windows\\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe"	4104a3469da45fexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}\stubpath = "C:\\Windows\\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe"	{28DC3993-F932-442d-A202-D933CDD6220C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6066EC43-25A1-46b6-A082-EABB01DFB620}	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}\stubpath = "C:\\Windows\\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe"	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}\stubpath = "C:\\Windows\\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe"	{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57699AA0-0615-4304-A7D2-641274964775}	{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}	4104a3469da45fexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28DC3993-F932-442d-A202-D933CDD6220C}\stubpath = "C:\\Windows\\{28DC3993-F932-442d-A202-D933CDD6220C}.exe"	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}	{28DC3993-F932-442d-A202-D933CDD6220C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}	{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E068560C-8019-4f0a-8DF7-05D22479CD39}	{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{57699AA0-0615-4304-A7D2-641274964775}\stubpath = "C:\\Windows\\{57699AA0-0615-4304-A7D2-641274964775}.exe"	{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{28DC3993-F932-442d-A202-D933CDD6220C}	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6066EC43-25A1-46b6-A082-EABB01DFB620}\stubpath = "C:\\Windows\\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe"	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}\stubpath = "C:\\Windows\\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe"	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}\stubpath = "C:\\Windows\\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe"	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}\stubpath = "C:\\Windows\\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe"	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}	{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}\stubpath = "C:\\Windows\\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe"	{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}\stubpath = "C:\\Windows\\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe"	{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E068560C-8019-4f0a-8DF7-05D22479CD39}\stubpath = "C:\\Windows\\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe"	{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}	{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe

Deletes itself 1 IoCs

pid	Process
3064	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe
2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
2824	{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
2572	{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
2724	{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
2988	{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
2656	{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
2580	{57699AA0-0615-4304-A7D2-641274964775}.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\{28DC3993-F932-442d-A202-D933CDD6220C}.exe	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
File created	C:\Windows\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	{28DC3993-F932-442d-A202-D933CDD6220C}.exe
File created	C:\Windows\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
File created	C:\Windows\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
File created	C:\Windows\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
File created	C:\Windows\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe	{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
File created	C:\Windows\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe	{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
File created	C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	4104a3469da45fexeexeexeex.exe
File created	C:\Windows\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe	{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
File created	C:\Windows\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
File created	C:\Windows\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe	{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
File created	C:\Windows\{57699AA0-0615-4304-A7D2-641274964775}.exe	{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
File created	C:\Windows\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3032	4104a3469da45fexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
Token: SeIncBasePriorityPrivilege	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe
Token: SeIncBasePriorityPrivilege	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
Token: SeIncBasePriorityPrivilege	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
Token: SeIncBasePriorityPrivilege	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
Token: SeIncBasePriorityPrivilege	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
Token: SeIncBasePriorityPrivilege	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
Token: SeIncBasePriorityPrivilege	2824	{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
Token: SeIncBasePriorityPrivilege	2572	{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
Token: SeIncBasePriorityPrivilege	2724	{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
Token: SeIncBasePriorityPrivilege	2988	{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
Token: SeIncBasePriorityPrivilege	2656	{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3000	3032	4104a3469da45fexeexeexeex.exe	28
PID 3032 wrote to memory of 3000	3032	4104a3469da45fexeexeexeex.exe	28
PID 3032 wrote to memory of 3000	3032	4104a3469da45fexeexeexeex.exe	28
PID 3032 wrote to memory of 3000	3032	4104a3469da45fexeexeexeex.exe	28
PID 3032 wrote to memory of 3064	3032	4104a3469da45fexeexeexeex.exe	29
PID 3032 wrote to memory of 3064	3032	4104a3469da45fexeexeexeex.exe	29
PID 3032 wrote to memory of 3064	3032	4104a3469da45fexeexeexeex.exe	29
PID 3032 wrote to memory of 3064	3032	4104a3469da45fexeexeexeex.exe	29
PID 3000 wrote to memory of 944	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	30
PID 3000 wrote to memory of 944	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	30
PID 3000 wrote to memory of 944	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	30
PID 3000 wrote to memory of 944	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	30
PID 3000 wrote to memory of 2992	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	31
PID 3000 wrote to memory of 2992	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	31
PID 3000 wrote to memory of 2992	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	31
PID 3000 wrote to memory of 2992	3000	{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe	31
PID 944 wrote to memory of 2240	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	32
PID 944 wrote to memory of 2240	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	32
PID 944 wrote to memory of 2240	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	32
PID 944 wrote to memory of 2240	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	32
PID 944 wrote to memory of 2868	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	33
PID 944 wrote to memory of 2868	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	33
PID 944 wrote to memory of 2868	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	33
PID 944 wrote to memory of 2868	944	{28DC3993-F932-442d-A202-D933CDD6220C}.exe	33
PID 2240 wrote to memory of 2056	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	34
PID 2240 wrote to memory of 2056	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	34
PID 2240 wrote to memory of 2056	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	34
PID 2240 wrote to memory of 2056	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	34
PID 2240 wrote to memory of 1196	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	35
PID 2240 wrote to memory of 1196	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	35
PID 2240 wrote to memory of 1196	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	35
PID 2240 wrote to memory of 1196	2240	{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe	35
PID 2056 wrote to memory of 628	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	36
PID 2056 wrote to memory of 628	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	36
PID 2056 wrote to memory of 628	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	36
PID 2056 wrote to memory of 628	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	36
PID 2056 wrote to memory of 2068	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	37
PID 2056 wrote to memory of 2068	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	37
PID 2056 wrote to memory of 2068	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	37
PID 2056 wrote to memory of 2068	2056	{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe	37
PID 628 wrote to memory of 2880	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	38
PID 628 wrote to memory of 2880	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	38
PID 628 wrote to memory of 2880	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	38
PID 628 wrote to memory of 2880	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	38
PID 628 wrote to memory of 2948	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	39
PID 628 wrote to memory of 2948	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	39
PID 628 wrote to memory of 2948	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	39
PID 628 wrote to memory of 2948	628	{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe	39
PID 2880 wrote to memory of 1120	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	40
PID 2880 wrote to memory of 1120	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	40
PID 2880 wrote to memory of 1120	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	40
PID 2880 wrote to memory of 1120	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	40
PID 2880 wrote to memory of 268	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	41
PID 2880 wrote to memory of 268	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	41
PID 2880 wrote to memory of 268	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	41
PID 2880 wrote to memory of 268	2880	{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe	41
PID 1120 wrote to memory of 2824	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	42
PID 1120 wrote to memory of 2824	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	42
PID 1120 wrote to memory of 2824	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	42
PID 1120 wrote to memory of 2824	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	42
PID 1120 wrote to memory of 2112	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	43
PID 1120 wrote to memory of 2112	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	43
PID 1120 wrote to memory of 2112	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	43
PID 1120 wrote to memory of 2112	1120	{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe	43

C:\Users\Admin\AppData\Local\Temp\4104a3469da45fexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\4104a3469da45fexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
  C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\{28DC3993-F932-442d-A202-D933CDD6220C}.exe
    C:\Windows\{28DC3993-F932-442d-A202-D933CDD6220C}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
      C:\Windows\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Windows\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
        
        C:\Windows\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
      - C:\Windows\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
        
        C:\Windows\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
        
        C:\Windows\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
        
        C:\Windows\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
        
        C:\Windows\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
        
        C:\Windows\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
        
        C:\Windows\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
        
        C:\Windows\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
        
        C:\Windows\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Windows\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
        
        C:\Windows\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Windows\{57699AA0-0615-4304-A7D2-641274964775}.exe
        
        C:\Windows\{57699AA0-0615-4304-A7D2-641274964775}.exe
        14⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4D65F~1.EXE > nul
        14⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DD7FB~1.EXE > nul
        13⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0685~1.EXE > nul
        12⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5A88C~1.EXE > nul
        11⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{629C3~1.EXE > nul
        10⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{59371~1.EXE > nul
        9⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0980~1.EXE > nul
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50C68~1.EXE > nul
        7⤵
        
        PID:2948
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6066E~1.EXE > nul
        6⤵
        
        PID:2068
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{122E8~1.EXE > nul
        5⤵
        
        PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{28DC3~1.EXE > nul
      4⤵
      PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EF42E~1.EXE > nul
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4104A3~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe

Filesize
204KB

MD5
1263d05319e276cb57bb9c58d55cb4e1

SHA1
fc7c41c45822e102f03057fda473961dcc205a57

SHA256
38a6f6c76cd8e14e1c1ec086dd3c7e5af81f10b356ad56eb0f7689eb37cdd158

SHA512
225bd87aaac7eae022800c85733a2b64d6019ecf3c11bdd2da19297e7a59cad0fed611c8419258edde78a7de38a6640c255356e9c13835fb920d34dba357d837

Download Submit
C:\Windows\{122E8F4A-B96C-47e5-B509-1FD47EB701B0}.exe

Filesize
204KB

MD5
1263d05319e276cb57bb9c58d55cb4e1

SHA1
fc7c41c45822e102f03057fda473961dcc205a57

SHA256
38a6f6c76cd8e14e1c1ec086dd3c7e5af81f10b356ad56eb0f7689eb37cdd158

SHA512
225bd87aaac7eae022800c85733a2b64d6019ecf3c11bdd2da19297e7a59cad0fed611c8419258edde78a7de38a6640c255356e9c13835fb920d34dba357d837

Download Submit
C:\Windows\{28DC3993-F932-442d-A202-D933CDD6220C}.exe

Filesize
204KB

MD5
12bdc3bd68309321076c5ed6196bc875

SHA1
02a7a8e9f15419c609517b8cab6faf35b2b4503a

SHA256
fc7f956118b15701c87380038f311c57feae3485b9cbc833e312cb6290ae277a

SHA512
8b38931a86a7ec527b2d255c230c55069176b298bc8ac7e4f9915418c9ad9a3c806ed437157f08b2e873ad507361c4306b5fecec8ebb34d9dc0e7ecce48f1948

Download Submit
C:\Windows\{28DC3993-F932-442d-A202-D933CDD6220C}.exe

Filesize
204KB

MD5
12bdc3bd68309321076c5ed6196bc875

SHA1
02a7a8e9f15419c609517b8cab6faf35b2b4503a

SHA256
fc7f956118b15701c87380038f311c57feae3485b9cbc833e312cb6290ae277a

SHA512
8b38931a86a7ec527b2d255c230c55069176b298bc8ac7e4f9915418c9ad9a3c806ed437157f08b2e873ad507361c4306b5fecec8ebb34d9dc0e7ecce48f1948

Download Submit
C:\Windows\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe

Filesize
204KB

MD5
de3cedaede1a6fb165bb6fc69e6cd5f0

SHA1
0cfb4bc41bcef7c27815d12615f1dbf1b910c65f

SHA256
38ea94973a596fc3715dc18e2e312ceb1ab8ecee52a32d9b24a1a5f5e6a665f2

SHA512
1716ecf3a08059677515813f34ff5defad1818a661ffb67e16e5c4f3936d65f7d851904900b3236ad5234a67fe3d314cb7355390476bd82a59d2be6ff8fe72b5

Download Submit
C:\Windows\{4D65F2FD-05D5-40db-A864-B90ED6FF00DB}.exe

Filesize
204KB

MD5
de3cedaede1a6fb165bb6fc69e6cd5f0

SHA1
0cfb4bc41bcef7c27815d12615f1dbf1b910c65f

SHA256
38ea94973a596fc3715dc18e2e312ceb1ab8ecee52a32d9b24a1a5f5e6a665f2

SHA512
1716ecf3a08059677515813f34ff5defad1818a661ffb67e16e5c4f3936d65f7d851904900b3236ad5234a67fe3d314cb7355390476bd82a59d2be6ff8fe72b5

Download Submit
C:\Windows\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe

Filesize
204KB

MD5
f0224b4e57d6fefd2f828169bf293513

SHA1
daaf2d33eebc03669ed3de4d66c68ccf9bbfb8bf

SHA256
6db5bb0f47940f3e427a8a6b5ec0430270024df68662547320202482f6e41d77

SHA512
58e7249db3ab91f3bdf34a3871cb04bcb7543bc7461ca20640112a7605a1ce622057fbc1e627cc643a44f9d103f0c5d152ea937122baca060cbb2ba2560eb1d0

Download Submit
C:\Windows\{50C68E9C-EC6E-4a4b-B288-F0F30FD54616}.exe

Filesize
204KB

MD5
f0224b4e57d6fefd2f828169bf293513

SHA1
daaf2d33eebc03669ed3de4d66c68ccf9bbfb8bf

SHA256
6db5bb0f47940f3e427a8a6b5ec0430270024df68662547320202482f6e41d77

SHA512
58e7249db3ab91f3bdf34a3871cb04bcb7543bc7461ca20640112a7605a1ce622057fbc1e627cc643a44f9d103f0c5d152ea937122baca060cbb2ba2560eb1d0

Download Submit
C:\Windows\{57699AA0-0615-4304-A7D2-641274964775}.exe

Filesize
204KB

MD5
8daa5700cfde69109b18ed6cbd52177a

SHA1
c1f20e368d49cf77bea80efc42fce7f35a2262c0

SHA256
c77881af9be86616bbed11a1901b69254e5b081eb34b2b73bebe192da69958e3

SHA512
ee65b9bfdead04b1f061fd6922bad4deb9dd45ecef7a7cc3b68c2cba87f5697f185b7bd80280fa3a068ea48db3d447b315e929f9e073f24a4698a117d0f63b8f

Download Submit
C:\Windows\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe

Filesize
204KB

MD5
8467111e2d48956a1a4d71a2b56b0824

SHA1
d8ee94fafa0041b29d76206b506fa38baed75f77

SHA256
922cb809da71ae7f85fdaafb70a329446d2e709458789a8adf2ac7eed613d57c

SHA512
f77919df3cfbda272f505cc8c7d4c90d8410fc671d5d7b2399b45b51e305f299161e5a0e54b62c3088373f9d6f98aac08b805bbf8bf176c850a85c1400be5170

Download Submit
C:\Windows\{59371F5B-52C4-4df8-B37A-0772B1C96BE9}.exe

Filesize
204KB

MD5
8467111e2d48956a1a4d71a2b56b0824

SHA1
d8ee94fafa0041b29d76206b506fa38baed75f77

SHA256
922cb809da71ae7f85fdaafb70a329446d2e709458789a8adf2ac7eed613d57c

SHA512
f77919df3cfbda272f505cc8c7d4c90d8410fc671d5d7b2399b45b51e305f299161e5a0e54b62c3088373f9d6f98aac08b805bbf8bf176c850a85c1400be5170

Download Submit
C:\Windows\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe

Filesize
204KB

MD5
1c524ab1c4ede43ae1f8d6ab91d0f10d

SHA1
371b308a39f9552e89747da493ce2d56419fce92

SHA256
3abc38600c210170aeddedd7649c45c4e7f6dc0e5bf3f782bffa8834ff241486

SHA512
50a1fa4fe95c4d11f3bd7ea0347bac2418602968ff7ebea961c57f97df93166ec831f7e92a67c7723c478dcbf635e1e9f1c07787b83342884bf877496d88b02f

Download Submit
C:\Windows\{5A88C1F2-5A70-478e-96B4-6F7543B26E75}.exe

Filesize
204KB

MD5
1c524ab1c4ede43ae1f8d6ab91d0f10d

SHA1
371b308a39f9552e89747da493ce2d56419fce92

SHA256
3abc38600c210170aeddedd7649c45c4e7f6dc0e5bf3f782bffa8834ff241486

SHA512
50a1fa4fe95c4d11f3bd7ea0347bac2418602968ff7ebea961c57f97df93166ec831f7e92a67c7723c478dcbf635e1e9f1c07787b83342884bf877496d88b02f

Download Submit
C:\Windows\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe

Filesize
204KB

MD5
36dda4b419b7f1889b8280df84662a4a

SHA1
d9b4d7993e15ff1e69a91f8f0539d3defb7f6e50

SHA256
228faf703e00cd120f26e0167d758af8dfae10e5e644b75acded1106ff6c235f

SHA512
284945f5a1af15f578dcf00c0730b09433b4669013b2b7cf6e9718c5b382af288c03ac0cea9fa1f39567a2e9832ef83ef522000fc15b1cc08f9c1d76eb452aa3

Download Submit
C:\Windows\{6066EC43-25A1-46b6-A082-EABB01DFB620}.exe

Filesize
204KB

MD5
36dda4b419b7f1889b8280df84662a4a

SHA1
d9b4d7993e15ff1e69a91f8f0539d3defb7f6e50

SHA256
228faf703e00cd120f26e0167d758af8dfae10e5e644b75acded1106ff6c235f

SHA512
284945f5a1af15f578dcf00c0730b09433b4669013b2b7cf6e9718c5b382af288c03ac0cea9fa1f39567a2e9832ef83ef522000fc15b1cc08f9c1d76eb452aa3

Download Submit
C:\Windows\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe

Filesize
204KB

MD5
26360066aaf4e635b61d55376ea46dc1

SHA1
b0d50fecba0b47acb10ff7df1c9714838e343f40

SHA256
df881d42edbed26bf0b6081e047d03b012695db406e57dfba6ebc7dc98257165

SHA512
aa1af755626899a38095138e3e5c3395feb711031dc93bbcbc54f29c2d8aedea0b95a58ebfe409fa9beb4ead486faf8d562a3d5fdde30c6d1f00b94f42129836

Download Submit
C:\Windows\{629C3AA1-85A1-46d7-B31F-F6291DD787D2}.exe

Filesize
204KB

MD5
26360066aaf4e635b61d55376ea46dc1

SHA1
b0d50fecba0b47acb10ff7df1c9714838e343f40

SHA256
df881d42edbed26bf0b6081e047d03b012695db406e57dfba6ebc7dc98257165

SHA512
aa1af755626899a38095138e3e5c3395feb711031dc93bbcbc54f29c2d8aedea0b95a58ebfe409fa9beb4ead486faf8d562a3d5fdde30c6d1f00b94f42129836

Download Submit
C:\Windows\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe

Filesize
204KB

MD5
c51599c43dd7cfebcde666fca0b8d5db

SHA1
89c33ae4f600d9fd1cf573a656b915c107a20743

SHA256
5ec3a6ee049a1791d55c4bf2ee19bfdb855e80669e9d44464edf186ba04eee45

SHA512
e40f66a23c1afd90b47aa559c5c49958ba3c6311cebbba408c1f5e7f03b70e2a11d82a05e0fefc98c2af31f761eca49f93d7a854a8b76040e0b680ad0059eaa5

Download Submit
C:\Windows\{DD7FB6FE-C07F-46c0-A8A1-CCDCBF2F263E}.exe

Filesize
204KB

MD5
c51599c43dd7cfebcde666fca0b8d5db

SHA1
89c33ae4f600d9fd1cf573a656b915c107a20743

SHA256
5ec3a6ee049a1791d55c4bf2ee19bfdb855e80669e9d44464edf186ba04eee45

SHA512
e40f66a23c1afd90b47aa559c5c49958ba3c6311cebbba408c1f5e7f03b70e2a11d82a05e0fefc98c2af31f761eca49f93d7a854a8b76040e0b680ad0059eaa5

Download Submit
C:\Windows\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe

Filesize
204KB

MD5
d16925d98d3150fe57a06392f75b1ca8

SHA1
89497819a471e5b6009d323d6233fe4cfd5f17c4

SHA256
b30759481c4316b2887bcb5798463753894933d4da8ddc41efb513bfa00e7d34

SHA512
0121650fc3963eb5969187957b6d164b61fe41aafd14743fe51205f803d3dc3a56333d01195d9391aa6dd5a0c9fbf2b1acac3c42daa91d07e22ed8b2fd730a17

Download Submit
C:\Windows\{E068560C-8019-4f0a-8DF7-05D22479CD39}.exe

Filesize
204KB

MD5
d16925d98d3150fe57a06392f75b1ca8

SHA1
89497819a471e5b6009d323d6233fe4cfd5f17c4

SHA256
b30759481c4316b2887bcb5798463753894933d4da8ddc41efb513bfa00e7d34

SHA512
0121650fc3963eb5969187957b6d164b61fe41aafd14743fe51205f803d3dc3a56333d01195d9391aa6dd5a0c9fbf2b1acac3c42daa91d07e22ed8b2fd730a17

Download Submit
C:\Windows\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe

Filesize
204KB

MD5
a89ed64b6e15407cf20180ab7d1e8154

SHA1
8c4bfd9b7f8ecd099418ade256beef55842a7392

SHA256
3472fc78dd4498756dfbbe966c4c608434e353b1826e5b4a3347c7c16208c0bf

SHA512
598d01b73ba8e2424c4052b019750e1e75b33e073b5dfa20527ead6c1996356ace93b4939f72a1abcf094b20892b43098671424810eedf513ac9f3b19871fa44

Download Submit
C:\Windows\{E0980FE8-8EE1-4ab8-9AE1-C3E0EDB4AB89}.exe

Filesize
204KB

MD5
a89ed64b6e15407cf20180ab7d1e8154

SHA1
8c4bfd9b7f8ecd099418ade256beef55842a7392

SHA256
3472fc78dd4498756dfbbe966c4c608434e353b1826e5b4a3347c7c16208c0bf

SHA512
598d01b73ba8e2424c4052b019750e1e75b33e073b5dfa20527ead6c1996356ace93b4939f72a1abcf094b20892b43098671424810eedf513ac9f3b19871fa44

Download Submit
C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe

Filesize
204KB

MD5
459ac9c2c610db6683898cd8aa2afaee

SHA1
dd4c9b4dd7e394e6d3cb6c47e92155f14ad51795

SHA256
057f5268c35dfa7ee45892b407d40b6d4d176fdec3527fd87a1520c8758e0227

SHA512
d774682849ced7fec8cf417132879f6c9430cf387ff082256d9a153f39aa6ed5dfbcf37e3951529c020371df6dbabd73085e9bc4bd8fa5dfef9d88e52b3bb66d

Download Submit
C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe

Filesize
204KB

MD5
459ac9c2c610db6683898cd8aa2afaee

SHA1
dd4c9b4dd7e394e6d3cb6c47e92155f14ad51795

SHA256
057f5268c35dfa7ee45892b407d40b6d4d176fdec3527fd87a1520c8758e0227

SHA512
d774682849ced7fec8cf417132879f6c9430cf387ff082256d9a153f39aa6ed5dfbcf37e3951529c020371df6dbabd73085e9bc4bd8fa5dfef9d88e52b3bb66d

Download Submit
C:\Windows\{EF42E913-2B71-47d9-9A25-C520F5A80A1E}.exe

Filesize
204KB

MD5
459ac9c2c610db6683898cd8aa2afaee

SHA1
dd4c9b4dd7e394e6d3cb6c47e92155f14ad51795

SHA256
057f5268c35dfa7ee45892b407d40b6d4d176fdec3527fd87a1520c8758e0227

SHA512
d774682849ced7fec8cf417132879f6c9430cf387ff082256d9a153f39aa6ed5dfbcf37e3951529c020371df6dbabd73085e9bc4bd8fa5dfef9d88e52b3bb66d

Download Submit