c0967e4840ed300b7aedb3c8ea69d679a10d6ce623b838821329c899e99afc82

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2023, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51660088828d7eexeexeexeex.exe
Size

372KB
MD5

51660088828d7eb3246bdca921b72183
SHA1

46f17a1b539e4eb46be4c878a36f568cd7b93573
SHA256

c0967e4840ed300b7aedb3c8ea69d679a10d6ce623b838821329c899e99afc82
SHA512

abeb71d24a63d15ca6c587433ff0e1ef33bada47752c4b7b2dbcfcdc7229435c189689915829d434b2b4b8813b224fec6ea5a5ec0119e178049b968edba4bb68
SSDEEP

3072:CEGh0oVmlJOiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBE:CEGSl/Oe2MUVg3vTeKcAEciTBqr3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB47692-EA6C-436a-A713-3697EDE450CB}	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DD4F359-4C85-450f-817A-0354E28F55A2}	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{941ABE46-0F69-44a7-941D-63D181B5DF65}	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{941ABE46-0F69-44a7-941D-63D181B5DF65}\stubpath = "C:\\Windows\\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe"	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}\stubpath = "C:\\Windows\\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe"	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{782C3D2C-9956-4445-A74D-BD790DF4E072}	{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DD4F359-4C85-450f-817A-0354E28F55A2}\stubpath = "C:\\Windows\\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe"	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}\stubpath = "C:\\Windows\\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe"	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30338517-FD18-4efe-93A5-82EC5C184BF1}\stubpath = "C:\\Windows\\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe"	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}	51660088828d7eexeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}\stubpath = "C:\\Windows\\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe"	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}\stubpath = "C:\\Windows\\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe"	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB47692-EA6C-436a-A713-3697EDE450CB}\stubpath = "C:\\Windows\\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe"	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{782C3D2C-9956-4445-A74D-BD790DF4E072}\stubpath = "C:\\Windows\\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe"	{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}\stubpath = "C:\\Windows\\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe"	51660088828d7eexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}\stubpath = "C:\\Windows\\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe"	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}\stubpath = "C:\\Windows\\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe"	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30338517-FD18-4efe-93A5-82EC5C184BF1}	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe

Executes dropped EXE 12 IoCs

pid	Process
4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
4560	{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
460	{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe	{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
File created	C:\Windows\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	51660088828d7eexeexeexeex.exe
File created	C:\Windows\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
File created	C:\Windows\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
File created	C:\Windows\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
File created	C:\Windows\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
File created	C:\Windows\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
File created	C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
File created	C:\Windows\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
File created	C:\Windows\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
File created	C:\Windows\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
File created	C:\Windows\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3200	51660088828d7eexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
Token: SeIncBasePriorityPrivilege	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
Token: SeIncBasePriorityPrivilege	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
Token: SeIncBasePriorityPrivilege	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
Token: SeIncBasePriorityPrivilege	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
Token: SeIncBasePriorityPrivilege	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
Token: SeIncBasePriorityPrivilege	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
Token: SeIncBasePriorityPrivilege	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
Token: SeIncBasePriorityPrivilege	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
Token: SeIncBasePriorityPrivilege	2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
Token: SeIncBasePriorityPrivilege	4560	{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4788	3200	51660088828d7eexeexeexeex.exe	85
PID 3200 wrote to memory of 4788	3200	51660088828d7eexeexeexeex.exe	85
PID 3200 wrote to memory of 4788	3200	51660088828d7eexeexeexeex.exe	85
PID 3200 wrote to memory of 2668	3200	51660088828d7eexeexeexeex.exe	86
PID 3200 wrote to memory of 2668	3200	51660088828d7eexeexeexeex.exe	86
PID 3200 wrote to memory of 2668	3200	51660088828d7eexeexeexeex.exe	86
PID 4788 wrote to memory of 264	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	87
PID 4788 wrote to memory of 264	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	87
PID 4788 wrote to memory of 264	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	87
PID 4788 wrote to memory of 2892	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	88
PID 4788 wrote to memory of 2892	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	88
PID 4788 wrote to memory of 2892	4788	{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe	88
PID 264 wrote to memory of 4888	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	93
PID 264 wrote to memory of 4888	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	93
PID 264 wrote to memory of 4888	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	93
PID 264 wrote to memory of 4932	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	92
PID 264 wrote to memory of 4932	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	92
PID 264 wrote to memory of 4932	264	{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe	92
PID 4888 wrote to memory of 3292	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	94
PID 4888 wrote to memory of 3292	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	94
PID 4888 wrote to memory of 3292	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	94
PID 4888 wrote to memory of 4604	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	95
PID 4888 wrote to memory of 4604	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	95
PID 4888 wrote to memory of 4604	4888	{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe	95
PID 3292 wrote to memory of 4552	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	96
PID 3292 wrote to memory of 4552	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	96
PID 3292 wrote to memory of 4552	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	96
PID 3292 wrote to memory of 2104	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	97
PID 3292 wrote to memory of 2104	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	97
PID 3292 wrote to memory of 2104	3292	{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe	97
PID 4552 wrote to memory of 2920	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	98
PID 4552 wrote to memory of 2920	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	98
PID 4552 wrote to memory of 2920	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	98
PID 4552 wrote to memory of 1848	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	99
PID 4552 wrote to memory of 1848	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	99
PID 4552 wrote to memory of 1848	4552	{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe	99
PID 2920 wrote to memory of 4004	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	100
PID 2920 wrote to memory of 4004	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	100
PID 2920 wrote to memory of 4004	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	100
PID 2920 wrote to memory of 3864	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	101
PID 2920 wrote to memory of 3864	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	101
PID 2920 wrote to memory of 3864	2920	{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe	101
PID 4004 wrote to memory of 4368	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	102
PID 4004 wrote to memory of 4368	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	102
PID 4004 wrote to memory of 4368	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	102
PID 4004 wrote to memory of 1700	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	103
PID 4004 wrote to memory of 1700	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	103
PID 4004 wrote to memory of 1700	4004	{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe	103
PID 4368 wrote to memory of 3148	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	104
PID 4368 wrote to memory of 3148	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	104
PID 4368 wrote to memory of 3148	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	104
PID 4368 wrote to memory of 1872	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	105
PID 4368 wrote to memory of 1872	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	105
PID 4368 wrote to memory of 1872	4368	{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe	105
PID 3148 wrote to memory of 2324	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	106
PID 3148 wrote to memory of 2324	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	106
PID 3148 wrote to memory of 2324	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	106
PID 3148 wrote to memory of 3012	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	107
PID 3148 wrote to memory of 3012	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	107
PID 3148 wrote to memory of 3012	3148	{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe	107
PID 2324 wrote to memory of 4560	2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe	108
PID 2324 wrote to memory of 4560	2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe	108
PID 2324 wrote to memory of 4560	2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe	108
PID 2324 wrote to memory of 2064	2324	{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe	109

C:\Users\Admin\AppData\Local\Temp\51660088828d7eexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\51660088828d7eexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
  C:\Windows\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
    C:\Windows\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{2DDE0~1.EXE > nul
      4⤵
      PID:4932
  - - C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
      C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
        
        C:\Windows\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Windows\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
        
        C:\Windows\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
        
        C:\Windows\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
        
        C:\Windows\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
        
        C:\Windows\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
        
        C:\Windows\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
        
        C:\Windows\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
        
        C:\Windows\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
        
        C:\Windows\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe
        
        C:\Windows\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe
        13⤵
        Executes dropped EXE
        
        PID:460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0FB47~1.EXE > nul
        13⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D9A95~1.EXE > nul
        12⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30338~1.EXE > nul
        11⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0760~1.EXE > nul
        10⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1BFDD~1.EXE > nul
        9⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20647~1.EXE > nul
        8⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{941AB~1.EXE > nul
        7⤵
        
        PID:1848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5DD4F~1.EXE > nul
        6⤵
        
        PID:2104
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D49B3~1.EXE > nul
        5⤵
        
        PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{570D1~1.EXE > nul
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\516600~1.EXE > nul
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe

Filesize
372KB

MD5
d391beebbb8307febecdd9ac7c3bb4dd

SHA1
dc09e9feec6a8b4bfcad8266b56b0a89cbd0e41a

SHA256
b4117caf20ac7e77f549873d367e00803088856b378ca1f39c10a9b9e8d49480

SHA512
6e08032e4dd766c9f2377ccee3436e0d961a3bc3a46fdc91d0999be73e7123759b9beb3d8b9bd49cfa8fe8f9939adcff40d574c1edbf3cf8921256f1caf8ea14

Download Submit
C:\Windows\{0FB47692-EA6C-436a-A713-3697EDE450CB}.exe

Filesize
372KB

MD5
d391beebbb8307febecdd9ac7c3bb4dd

SHA1
dc09e9feec6a8b4bfcad8266b56b0a89cbd0e41a

SHA256
b4117caf20ac7e77f549873d367e00803088856b378ca1f39c10a9b9e8d49480

SHA512
6e08032e4dd766c9f2377ccee3436e0d961a3bc3a46fdc91d0999be73e7123759b9beb3d8b9bd49cfa8fe8f9939adcff40d574c1edbf3cf8921256f1caf8ea14

Download Submit
C:\Windows\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe

Filesize
372KB

MD5
4fbab563b065c7ed125f255808e04817

SHA1
b8dd55c57360ca0de43d5e253a7641728517a95c

SHA256
a02d1dd066814c9ca7163b29b690a6ae1f7a1f8e5c59ad5b352348e8c11f4427

SHA512
1a769d86dcbc2122fa6fe57b6bf2f4291960cc8ff0510231698add5d39aa03c6e353f8d252fc467dabd73da82354661f31d43c52b681bb57bc7624e3ddff3ae5

Download Submit
C:\Windows\{1BFDDDA2-DDC9-420c-9CBF-0014C91BE315}.exe

Filesize
372KB

MD5
4fbab563b065c7ed125f255808e04817

SHA1
b8dd55c57360ca0de43d5e253a7641728517a95c

SHA256
a02d1dd066814c9ca7163b29b690a6ae1f7a1f8e5c59ad5b352348e8c11f4427

SHA512
1a769d86dcbc2122fa6fe57b6bf2f4291960cc8ff0510231698add5d39aa03c6e353f8d252fc467dabd73da82354661f31d43c52b681bb57bc7624e3ddff3ae5

Download Submit
C:\Windows\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe

Filesize
372KB

MD5
bda54f8f4cc0147d5fee7cc0b46faa37

SHA1
75c091f4161e3611cfb0e1159a91155cc6545cc1

SHA256
dd03defa1650e209860acb29e504a34a2dc411f018de9a871120d84e362cf8e9

SHA512
2b4e0e222f5309b19ec94e2efaba8cacb1abb98640c12a4a50b29ae89c6e14eba62e183f15d6b3ba1a90632245f1e04ccfb577b71b97975d170c5a226be392b9

Download Submit
C:\Windows\{20647D31-1B57-4964-9FB5-D4992F9F4BA5}.exe

Filesize
372KB

MD5
bda54f8f4cc0147d5fee7cc0b46faa37

SHA1
75c091f4161e3611cfb0e1159a91155cc6545cc1

SHA256
dd03defa1650e209860acb29e504a34a2dc411f018de9a871120d84e362cf8e9

SHA512
2b4e0e222f5309b19ec94e2efaba8cacb1abb98640c12a4a50b29ae89c6e14eba62e183f15d6b3ba1a90632245f1e04ccfb577b71b97975d170c5a226be392b9

Download Submit
C:\Windows\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe

Filesize
372KB

MD5
067a829b598cb4e9c11e7e6140d574ae

SHA1
97cf029720240bff5208c4dee427e070fa9f0864

SHA256
434a0f432a2fd90717a932a36f0fa34de193a6f0bc34fbb6a30961ba55564569

SHA512
8282332f28fa58cc0192d6322e084acf6dede4e4924d5596e2a842b7c455922df7241f57f6f99474546a640e78cc8de89ae2b30e5e2ea0ac75606cb64b1239bc

Download Submit
C:\Windows\{2DDE0AE9-52B5-4216-8D0E-C3C13388FEEC}.exe

Filesize
372KB

MD5
067a829b598cb4e9c11e7e6140d574ae

SHA1
97cf029720240bff5208c4dee427e070fa9f0864

SHA256
434a0f432a2fd90717a932a36f0fa34de193a6f0bc34fbb6a30961ba55564569

SHA512
8282332f28fa58cc0192d6322e084acf6dede4e4924d5596e2a842b7c455922df7241f57f6f99474546a640e78cc8de89ae2b30e5e2ea0ac75606cb64b1239bc

Download Submit
C:\Windows\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe

Filesize
372KB

MD5
6ddc10489e1b816dd4bde60076cde455

SHA1
33d85bab3f313535212ff353f551fd37f6db6774

SHA256
8e7f2aaa4566051d094252c09cb4013217df4fec9b3d5e1d11be40ca84f45caf

SHA512
25e4c1b32362bd860aeb8b7593daf638f3bedca34442a38493b94dbc8b60a49b4654e2dc3d61b9c9395540a17a1eaa7e105e897069f54981cd63a69d6a5f39d2

Download Submit
C:\Windows\{30338517-FD18-4efe-93A5-82EC5C184BF1}.exe

Filesize
372KB

MD5
6ddc10489e1b816dd4bde60076cde455

SHA1
33d85bab3f313535212ff353f551fd37f6db6774

SHA256
8e7f2aaa4566051d094252c09cb4013217df4fec9b3d5e1d11be40ca84f45caf

SHA512
25e4c1b32362bd860aeb8b7593daf638f3bedca34442a38493b94dbc8b60a49b4654e2dc3d61b9c9395540a17a1eaa7e105e897069f54981cd63a69d6a5f39d2

Download Submit
C:\Windows\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe

Filesize
372KB

MD5
5efb0cce8a77830ca7b213aefe8170f5

SHA1
f2c18967f05030bc242f83760ef0d407473f0481

SHA256
0c8c60ef276646dba6c589f62a129422ac99431c1d68f11adbee54fd28c7264e

SHA512
001e64bda384424ee804df3b836bfc36807a4bb4e6d00f38accb6d3fc19b55defc75a1a2c05fdbf78d76ed1962bb2b144929dc7da7e55576df9cf03a2bbb3d32

Download Submit
C:\Windows\{570D136F-C198-4b9a-B5F3-BC9EBAC4DB7B}.exe

Filesize
372KB

MD5
5efb0cce8a77830ca7b213aefe8170f5

SHA1
f2c18967f05030bc242f83760ef0d407473f0481

SHA256
0c8c60ef276646dba6c589f62a129422ac99431c1d68f11adbee54fd28c7264e

SHA512
001e64bda384424ee804df3b836bfc36807a4bb4e6d00f38accb6d3fc19b55defc75a1a2c05fdbf78d76ed1962bb2b144929dc7da7e55576df9cf03a2bbb3d32

Download Submit
C:\Windows\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe

Filesize
372KB

MD5
862db46541a1005463bbbd62cdb65e1b

SHA1
a25b7ab808d6bb353f4103f27cce7208fab1ea79

SHA256
27cae6c987b0932df9568ec3249bbdece248d627db8ec028f58aa655c9b01cb3

SHA512
5c862c9413cd6022212cf99501a490469ab4b21298510f5a344415acb17cc49260b90cb5fa921ddc5cacfb8b36803aaf0fe6ef32018eab15f6850f6c1be42050

Download Submit
C:\Windows\{5DD4F359-4C85-450f-817A-0354E28F55A2}.exe

Filesize
372KB

MD5
862db46541a1005463bbbd62cdb65e1b

SHA1
a25b7ab808d6bb353f4103f27cce7208fab1ea79

SHA256
27cae6c987b0932df9568ec3249bbdece248d627db8ec028f58aa655c9b01cb3

SHA512
5c862c9413cd6022212cf99501a490469ab4b21298510f5a344415acb17cc49260b90cb5fa921ddc5cacfb8b36803aaf0fe6ef32018eab15f6850f6c1be42050

Download Submit
C:\Windows\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe

Filesize
372KB

MD5
519c700c817cf5d085121609474626ef

SHA1
7d7692e0f6324ae6f53c35fdd1d5bbf3e838b40e

SHA256
c0df0389b3fa398508b7ed064c745e38f7b7bfe5d2495e4b0cd9b8e05936e860

SHA512
4bedcfd7d146d45c80ab4a684ce819c7e4010079528f26cc0ebe4355ce718bcd9b061f831248a846cac49e8ddd731e1c42cab1f9899e64be8764f8a3626e94f8

Download Submit
C:\Windows\{782C3D2C-9956-4445-A74D-BD790DF4E072}.exe

Filesize
372KB

MD5
519c700c817cf5d085121609474626ef

SHA1
7d7692e0f6324ae6f53c35fdd1d5bbf3e838b40e

SHA256
c0df0389b3fa398508b7ed064c745e38f7b7bfe5d2495e4b0cd9b8e05936e860

SHA512
4bedcfd7d146d45c80ab4a684ce819c7e4010079528f26cc0ebe4355ce718bcd9b061f831248a846cac49e8ddd731e1c42cab1f9899e64be8764f8a3626e94f8

Download Submit
C:\Windows\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe

Filesize
372KB

MD5
fc33edc855201ddb83da871b7af74834

SHA1
94582ff285158139a59b27eef580a950213e5a0d

SHA256
ae13c757a548debdfe406a113d1a60b20326e006f53f1c7d9341a6a852e86950

SHA512
e15b356edff2eb8caf4503ef20e1a196ad90755d3aa4da97744b61dcba90b3362e3553bfe96b711d6a45a44c8d2dd6c332b10241375f6a13601e81983f58123e

Download Submit
C:\Windows\{941ABE46-0F69-44a7-941D-63D181B5DF65}.exe

Filesize
372KB

MD5
fc33edc855201ddb83da871b7af74834

SHA1
94582ff285158139a59b27eef580a950213e5a0d

SHA256
ae13c757a548debdfe406a113d1a60b20326e006f53f1c7d9341a6a852e86950

SHA512
e15b356edff2eb8caf4503ef20e1a196ad90755d3aa4da97744b61dcba90b3362e3553bfe96b711d6a45a44c8d2dd6c332b10241375f6a13601e81983f58123e

Download Submit
C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe

Filesize
372KB

MD5
3d2db9b900e4524039f95c803806d532

SHA1
0eda013c89683d3294bf72f6bab431d6d0257de1

SHA256
2872787c94f2bf7c74a21448cc126dee5c0a7a13ea5105ae9a8ad6f0189a3cf3

SHA512
c13b4697f91354c5743851b65e749b9bd77db6fbef40600edbd6edc7c1d914f57399f21cb1c179b8e500fe4c209f9ade818f87a99ad1af08818c633145cdbb91

Download Submit
C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe

Filesize
372KB

MD5
3d2db9b900e4524039f95c803806d532

SHA1
0eda013c89683d3294bf72f6bab431d6d0257de1

SHA256
2872787c94f2bf7c74a21448cc126dee5c0a7a13ea5105ae9a8ad6f0189a3cf3

SHA512
c13b4697f91354c5743851b65e749b9bd77db6fbef40600edbd6edc7c1d914f57399f21cb1c179b8e500fe4c209f9ade818f87a99ad1af08818c633145cdbb91

Download Submit
C:\Windows\{D49B358B-47B6-44fc-A9E6-1AFB924241F1}.exe

Filesize
372KB

MD5
3d2db9b900e4524039f95c803806d532

SHA1
0eda013c89683d3294bf72f6bab431d6d0257de1

SHA256
2872787c94f2bf7c74a21448cc126dee5c0a7a13ea5105ae9a8ad6f0189a3cf3

SHA512
c13b4697f91354c5743851b65e749b9bd77db6fbef40600edbd6edc7c1d914f57399f21cb1c179b8e500fe4c209f9ade818f87a99ad1af08818c633145cdbb91

Download Submit
C:\Windows\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe

Filesize
372KB

MD5
a15c923af005ca143b4b21cf14cac073

SHA1
62502d1a0c2714af8b9e90d6c440bf30abda45ee

SHA256
122091a2b2f286d69f96598c3ae282decdecb38f34d4e007e42fc3e4eff7ec74

SHA512
d4c36fab31c269980bac7c661b7d231676933460b617387a669cf30f74924d2c48e92507b6eaf896623791830ba5620887fcc17887c315851c3fe66f3236aca8

Download Submit
C:\Windows\{D9A9506E-AA3D-45dd-9A61-6302DEBF8AE8}.exe

Filesize
372KB

MD5
a15c923af005ca143b4b21cf14cac073

SHA1
62502d1a0c2714af8b9e90d6c440bf30abda45ee

SHA256
122091a2b2f286d69f96598c3ae282decdecb38f34d4e007e42fc3e4eff7ec74

SHA512
d4c36fab31c269980bac7c661b7d231676933460b617387a669cf30f74924d2c48e92507b6eaf896623791830ba5620887fcc17887c315851c3fe66f3236aca8

Download Submit
C:\Windows\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe

Filesize
372KB

MD5
7a41fc95fa45f99462015edb5085539f

SHA1
bc21d6a3d46cd0be99b2e7a2a1ae6c07c969d7ce

SHA256
8c7c6ee595c44d9038894ac6690f7306b4f032662ab77a59277d59962c8c7e0d

SHA512
ffc9e5241a84f22b018a17310cb352c03b0682224cb27afde82ba69b81cfa3fceec97615a8695bb7b6056cf8bd54bc5ea7d244bc333546b996cb5dbf518e82c1

Download Submit
C:\Windows\{E0760E49-DBF4-4d22-95E1-7206F03E74D0}.exe

Filesize
372KB

MD5
7a41fc95fa45f99462015edb5085539f

SHA1
bc21d6a3d46cd0be99b2e7a2a1ae6c07c969d7ce

SHA256
8c7c6ee595c44d9038894ac6690f7306b4f032662ab77a59277d59962c8c7e0d

SHA512
ffc9e5241a84f22b018a17310cb352c03b0682224cb27afde82ba69b81cfa3fceec97615a8695bb7b6056cf8bd54bc5ea7d244bc333546b996cb5dbf518e82c1

Download Submit