582755448ca6b13c05d4c1f4f5d6aebbf7cae05a8f8c2f15ca031b4c8e92ba64

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69fd63ba7a784eexeexeexeex.exe
Size

168KB
MD5

69fd63ba7a784e689fde4b61fb311484
SHA1

25b9b48fdd9fb774ad61a6946a4fe5a2b5cd4e25
SHA256

582755448ca6b13c05d4c1f4f5d6aebbf7cae05a8f8c2f15ca031b4c8e92ba64
SHA512

693dbc886d39bbcf3cbdcb169269a0de8e7504d0dbd017740a9e812cb741ccd52e9e9cf0d7bc656b21c0595dc5285f6cb5dffaa263dbcf462bcd25cfb836b2c2
SSDEEP

1536:1EGh0o3lq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0o3lqOPOe2MUVg3Ve+rX

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34A83A9F-8C98-4ef5-A727-C2361215AE47}	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E24CE93-4ABE-4112-8326-FBF564C2961F}	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}\stubpath = "C:\\Windows\\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe"	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{150E80BD-B816-4027-8D59-D7B93DC41698}\stubpath = "C:\\Windows\\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe"	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E094F8A-5780-480e-A427-87351394A017}	{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{145EA88D-4FA0-4486-B112-B29D8444CBF7}\stubpath = "C:\\Windows\\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe"	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B4FF066-42F5-4b54-B436-A954743CE4B2}	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B4FF066-42F5-4b54-B436-A954743CE4B2}\stubpath = "C:\\Windows\\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe"	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E094F8A-5780-480e-A427-87351394A017}\stubpath = "C:\\Windows\\{7E094F8A-5780-480e-A427-87351394A017}.exe"	{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}	69fd63ba7a784eexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B13634A5-133D-4127-A829-2D8EE2E958C0}\stubpath = "C:\\Windows\\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe"	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}\stubpath = "C:\\Windows\\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe"	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E24CE93-4ABE-4112-8326-FBF564C2961F}\stubpath = "C:\\Windows\\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe"	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}\stubpath = "C:\\Windows\\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe"	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34A83A9F-8C98-4ef5-A727-C2361215AE47}\stubpath = "C:\\Windows\\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe"	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}\stubpath = "C:\\Windows\\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe"	69fd63ba7a784eexeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{145EA88D-4FA0-4486-B112-B29D8444CBF7}	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A890371D-60D1-449c-97D3-04B80368A8EF}	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A890371D-60D1-449c-97D3-04B80368A8EF}\stubpath = "C:\\Windows\\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe"	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B13634A5-133D-4127-A829-2D8EE2E958C0}	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{150E80BD-B816-4027-8D59-D7B93DC41698}	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe

Executes dropped EXE 12 IoCs

pid	Process
1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
2352	{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
1308	{7E094F8A-5780-480e-A427-87351394A017}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
File created	C:\Windows\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
File created	C:\Windows\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
File created	C:\Windows\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
File created	C:\Windows\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
File created	C:\Windows\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
File created	C:\Windows\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	69fd63ba7a784eexeexeexeex.exe
File created	C:\Windows\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
File created	C:\Windows\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
File created	C:\Windows\{7E094F8A-5780-480e-A427-87351394A017}.exe	{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
File created	C:\Windows\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
File created	C:\Windows\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4256	69fd63ba7a784eexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
Token: SeIncBasePriorityPrivilege	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
Token: SeIncBasePriorityPrivilege	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
Token: SeIncBasePriorityPrivilege	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
Token: SeIncBasePriorityPrivilege	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
Token: SeIncBasePriorityPrivilege	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
Token: SeIncBasePriorityPrivilege	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
Token: SeIncBasePriorityPrivilege	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
Token: SeIncBasePriorityPrivilege	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
Token: SeIncBasePriorityPrivilege	4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
Token: SeIncBasePriorityPrivilege	2352	{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1944	4256	69fd63ba7a784eexeexeexeex.exe	84
PID 4256 wrote to memory of 1944	4256	69fd63ba7a784eexeexeexeex.exe	84
PID 4256 wrote to memory of 1944	4256	69fd63ba7a784eexeexeexeex.exe	84
PID 4256 wrote to memory of 1220	4256	69fd63ba7a784eexeexeexeex.exe	85
PID 4256 wrote to memory of 1220	4256	69fd63ba7a784eexeexeexeex.exe	85
PID 4256 wrote to memory of 1220	4256	69fd63ba7a784eexeexeexeex.exe	85
PID 1944 wrote to memory of 4504	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	86
PID 1944 wrote to memory of 4504	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	86
PID 1944 wrote to memory of 4504	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	86
PID 1944 wrote to memory of 4676	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	87
PID 1944 wrote to memory of 4676	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	87
PID 1944 wrote to memory of 4676	1944	{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe	87
PID 4504 wrote to memory of 2500	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	91
PID 4504 wrote to memory of 2500	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	91
PID 4504 wrote to memory of 2500	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	91
PID 4504 wrote to memory of 2776	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	92
PID 4504 wrote to memory of 2776	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	92
PID 4504 wrote to memory of 2776	4504	{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe	92
PID 2500 wrote to memory of 1828	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	93
PID 2500 wrote to memory of 1828	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	93
PID 2500 wrote to memory of 1828	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	93
PID 2500 wrote to memory of 4952	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	94
PID 2500 wrote to memory of 4952	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	94
PID 2500 wrote to memory of 4952	2500	{A890371D-60D1-449c-97D3-04B80368A8EF}.exe	94
PID 1828 wrote to memory of 3924	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	95
PID 1828 wrote to memory of 3924	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	95
PID 1828 wrote to memory of 3924	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	95
PID 1828 wrote to memory of 1168	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	96
PID 1828 wrote to memory of 1168	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	96
PID 1828 wrote to memory of 1168	1828	{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe	96
PID 3924 wrote to memory of 3688	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	97
PID 3924 wrote to memory of 3688	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	97
PID 3924 wrote to memory of 3688	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	97
PID 3924 wrote to memory of 3344	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	98
PID 3924 wrote to memory of 3344	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	98
PID 3924 wrote to memory of 3344	3924	{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe	98
PID 3688 wrote to memory of 2372	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	99
PID 3688 wrote to memory of 2372	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	99
PID 3688 wrote to memory of 2372	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	99
PID 3688 wrote to memory of 1548	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	100
PID 3688 wrote to memory of 1548	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	100
PID 3688 wrote to memory of 1548	3688	{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe	100
PID 2372 wrote to memory of 1444	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	101
PID 2372 wrote to memory of 1444	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	101
PID 2372 wrote to memory of 1444	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	101
PID 2372 wrote to memory of 4416	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	102
PID 2372 wrote to memory of 4416	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	102
PID 2372 wrote to memory of 4416	2372	{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe	102
PID 1444 wrote to memory of 2712	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	103
PID 1444 wrote to memory of 2712	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	103
PID 1444 wrote to memory of 2712	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	103
PID 1444 wrote to memory of 1224	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	104
PID 1444 wrote to memory of 1224	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	104
PID 1444 wrote to memory of 1224	1444	{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe	104
PID 2712 wrote to memory of 4692	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	105
PID 2712 wrote to memory of 4692	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	105
PID 2712 wrote to memory of 4692	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	105
PID 2712 wrote to memory of 3312	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	106
PID 2712 wrote to memory of 3312	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	106
PID 2712 wrote to memory of 3312	2712	{150E80BD-B816-4027-8D59-D7B93DC41698}.exe	106
PID 4692 wrote to memory of 2352	4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe	107
PID 4692 wrote to memory of 2352	4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe	107
PID 4692 wrote to memory of 2352	4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe	107
PID 4692 wrote to memory of 3112	4692	{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe	108

C:\Users\Admin\AppData\Local\Temp\69fd63ba7a784eexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\69fd63ba7a784eexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
  C:\Windows\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
    C:\Windows\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
      C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
        
        C:\Windows\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1828
      - C:\Windows\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
        
        C:\Windows\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
        
        C:\Windows\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
        
        C:\Windows\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
        
        C:\Windows\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
        
        C:\Windows\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
        
        C:\Windows\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
        
        C:\Windows\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\{7E094F8A-5780-480e-A427-87351394A017}.exe
        
        C:\Windows\{7E094F8A-5780-480e-A427-87351394A017}.exe
        13⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B4FF~1.EXE > nul
        13⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B7028~1.EXE > nul
        12⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{150E8~1.EXE > nul
        11⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{44F5E~1.EXE > nul
        10⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E24C~1.EXE > nul
        9⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{34A83~1.EXE > nul
        8⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AB768~1.EXE > nul
        7⤵
        
        PID:3344
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1363~1.EXE > nul
        6⤵
        
        PID:1168
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8903~1.EXE > nul
        5⤵
        
        PID:4952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{145EA~1.EXE > nul
      4⤵
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{41546~1.EXE > nul
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\69FD63~1.EXE > nul
  2⤵
  PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe

Filesize
168KB

MD5
b59ab4a2b86e347af2d6f86f7b944d6a

SHA1
73f242d667b8e615ee616f33a1b84fe78f665db8

SHA256
ad14e1bb8b0146669c6ef468c89f6a2d241b5a9fc88579ffe0d2787c53640c0d

SHA512
c144b3da6a35f2854250ee89f45c3508f4e60f8c904ea4c85de1b16ce1c49587b721dc837d61325dcc2ebf841c904fcc484745a68c2157d621b930687513b8c9

Download Submit
C:\Windows\{145EA88D-4FA0-4486-B112-B29D8444CBF7}.exe

Filesize
168KB

MD5
b59ab4a2b86e347af2d6f86f7b944d6a

SHA1
73f242d667b8e615ee616f33a1b84fe78f665db8

SHA256
ad14e1bb8b0146669c6ef468c89f6a2d241b5a9fc88579ffe0d2787c53640c0d

SHA512
c144b3da6a35f2854250ee89f45c3508f4e60f8c904ea4c85de1b16ce1c49587b721dc837d61325dcc2ebf841c904fcc484745a68c2157d621b930687513b8c9

Download Submit
C:\Windows\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe

Filesize
168KB

MD5
1e7412dc4d986fbb261e88589c1224f3

SHA1
fc0df74e95b625c6487d0ba0faa3456134dd74eb

SHA256
39c001946dd81c4932752b560b1a6f17ae3b52ab167ed5177c9b06817dfbbd1c

SHA512
6749ce9c65dc75f85d88143c2ee0dea986516605f41d5f37102a57510067582d95656d7bbb8bffe06139a4a1b7c685c380c00309c28b1e88eafdc0a4476a01b4

Download Submit
C:\Windows\{150E80BD-B816-4027-8D59-D7B93DC41698}.exe

Filesize
168KB

MD5
1e7412dc4d986fbb261e88589c1224f3

SHA1
fc0df74e95b625c6487d0ba0faa3456134dd74eb

SHA256
39c001946dd81c4932752b560b1a6f17ae3b52ab167ed5177c9b06817dfbbd1c

SHA512
6749ce9c65dc75f85d88143c2ee0dea986516605f41d5f37102a57510067582d95656d7bbb8bffe06139a4a1b7c685c380c00309c28b1e88eafdc0a4476a01b4

Download Submit
C:\Windows\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe

Filesize
168KB

MD5
d9cae9ad3b64ed7ace5f7baececf549a

SHA1
80a095f23209b9d4a3aef6aa5698cfb28dbc2323

SHA256
bc213676cbb953c07233963511e0a8ba030fb75a00668ab70e3b3b8db2c20704

SHA512
a4f735d866e49e410af88aa9716b3c91432864c3ef53ff412f7a485f5ae23d3b63a32881cca22cd7d05fddb37ff96bbd73c1ddc60e78723b83f74ba326b37b28

Download Submit
C:\Windows\{34A83A9F-8C98-4ef5-A727-C2361215AE47}.exe

Filesize
168KB

MD5
d9cae9ad3b64ed7ace5f7baececf549a

SHA1
80a095f23209b9d4a3aef6aa5698cfb28dbc2323

SHA256
bc213676cbb953c07233963511e0a8ba030fb75a00668ab70e3b3b8db2c20704

SHA512
a4f735d866e49e410af88aa9716b3c91432864c3ef53ff412f7a485f5ae23d3b63a32881cca22cd7d05fddb37ff96bbd73c1ddc60e78723b83f74ba326b37b28

Download Submit
C:\Windows\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe

Filesize
168KB

MD5
935cece92b1c34559252fde8b43dbe29

SHA1
93d686ab79a36b94a9a09b5e4e46960e6859d284

SHA256
cb91ad041c3e6ca1a9449e6a54d9b3fb7f0e8bafee3adad59551070aaa7f1b89

SHA512
29342feab5b08377d77ca651a7d06378b0543f95716719717294d08d4046a4b0f2d392bd929022c1386bd75de695e67b8e1800f78025b5e6e214b945ff7bc15a

Download Submit
C:\Windows\{41546900-5C05-4b7a-99E6-B535AEAE3AAE}.exe

Filesize
168KB

MD5
935cece92b1c34559252fde8b43dbe29

SHA1
93d686ab79a36b94a9a09b5e4e46960e6859d284

SHA256
cb91ad041c3e6ca1a9449e6a54d9b3fb7f0e8bafee3adad59551070aaa7f1b89

SHA512
29342feab5b08377d77ca651a7d06378b0543f95716719717294d08d4046a4b0f2d392bd929022c1386bd75de695e67b8e1800f78025b5e6e214b945ff7bc15a

Download Submit
C:\Windows\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe

Filesize
168KB

MD5
28c303ca580f049adaf359656471d2e5

SHA1
62dbc806787b0b222b4e50c1347de9d4005b7aca

SHA256
985e45c2846d987f45f8c73d82ea0aa5eb8a315cad296fb2c14e6afd3363ef30

SHA512
5bceaaf357a74e7cc65ed06e502a2cef4f4dd9cde8577c8eb8a1b764ccd6ac61deb60c08f475429da0fb18a6c94a5f85a30dfcf1744908041e8e28583c3d3ca8

Download Submit
C:\Windows\{44F5EC13-3C35-48ee-8308-DA7ECB6BC66B}.exe

Filesize
168KB

MD5
28c303ca580f049adaf359656471d2e5

SHA1
62dbc806787b0b222b4e50c1347de9d4005b7aca

SHA256
985e45c2846d987f45f8c73d82ea0aa5eb8a315cad296fb2c14e6afd3363ef30

SHA512
5bceaaf357a74e7cc65ed06e502a2cef4f4dd9cde8577c8eb8a1b764ccd6ac61deb60c08f475429da0fb18a6c94a5f85a30dfcf1744908041e8e28583c3d3ca8

Download Submit
C:\Windows\{7E094F8A-5780-480e-A427-87351394A017}.exe

Filesize
168KB

MD5
7e7b47c193d51e0e850b8950015a513c

SHA1
e93b3f7b532f02932637469ae6d8810c0617ad95

SHA256
853a98ff653c1b580752db0042b29dfb5dc75418609e6e6708c688c06f9dbe8b

SHA512
382a2c9fe575d645a3de434583fa5276839373d60cc8a2170e07e05e5270190d4144315e04d76940ce9eadb784633c3a4357cdb4fbc78cc953b58919e0c88d04

Download Submit
C:\Windows\{7E094F8A-5780-480e-A427-87351394A017}.exe

Filesize
168KB

MD5
7e7b47c193d51e0e850b8950015a513c

SHA1
e93b3f7b532f02932637469ae6d8810c0617ad95

SHA256
853a98ff653c1b580752db0042b29dfb5dc75418609e6e6708c688c06f9dbe8b

SHA512
382a2c9fe575d645a3de434583fa5276839373d60cc8a2170e07e05e5270190d4144315e04d76940ce9eadb784633c3a4357cdb4fbc78cc953b58919e0c88d04

Download Submit
C:\Windows\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe

Filesize
168KB

MD5
d659ce6ebbced92544ddbdab2778d1ff

SHA1
a59a1cb837ada27703d8f726987d3d80ef639f13

SHA256
8ae273e019a519391b353b43063e8c368a59f849eb86f56fe2b10c55102c3517

SHA512
44ffc73210bfeb359d6b355cc7acd014fa7ebbd373116ad9ba18695ef446bec95670da03abcce87ebaa4045cc7625d5a4d66f86c751d3ba8dae65650b2737820

Download Submit
C:\Windows\{7E24CE93-4ABE-4112-8326-FBF564C2961F}.exe

Filesize
168KB

MD5
d659ce6ebbced92544ddbdab2778d1ff

SHA1
a59a1cb837ada27703d8f726987d3d80ef639f13

SHA256
8ae273e019a519391b353b43063e8c368a59f849eb86f56fe2b10c55102c3517

SHA512
44ffc73210bfeb359d6b355cc7acd014fa7ebbd373116ad9ba18695ef446bec95670da03abcce87ebaa4045cc7625d5a4d66f86c751d3ba8dae65650b2737820

Download Submit
C:\Windows\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe

Filesize
168KB

MD5
981391b05c03b8505722ebc6c4ac78da

SHA1
23b9e227bf5f2b51406e3d2ae6be9652efab4ddb

SHA256
0cccfddfa288868556512f67fcb6e89f966d074d91117cd863f3c2d0f99b28a6

SHA512
8b9b294e225742e17c1481276c26b4d52ed1b6251cd377c9b69a326fff0977379610afc6e54bc8deca93650a91457047c8190d7401a244f03edfafb8d146d9b8

Download Submit
C:\Windows\{9B4FF066-42F5-4b54-B436-A954743CE4B2}.exe

Filesize
168KB

MD5
981391b05c03b8505722ebc6c4ac78da

SHA1
23b9e227bf5f2b51406e3d2ae6be9652efab4ddb

SHA256
0cccfddfa288868556512f67fcb6e89f966d074d91117cd863f3c2d0f99b28a6

SHA512
8b9b294e225742e17c1481276c26b4d52ed1b6251cd377c9b69a326fff0977379610afc6e54bc8deca93650a91457047c8190d7401a244f03edfafb8d146d9b8

Download Submit
C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe

Filesize
168KB

MD5
0765714af4a1af896abf2023156a842a

SHA1
ecf4726d6c80c0f13ce5a9b03783aeeccf56e9b8

SHA256
8de9c7210a9bf61c585d997f1e0b067f10e4d03bb6e12c080d25c8182bf0d071

SHA512
740d43a99f495163fa4eb73a51b15057ac97197a4cd37d0fbcbf1416258344a6f865a0e9f8a1920d880748a2e7350359d36a17aa94b059bf3e371bc4b4f424a8

Download Submit
C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe

Filesize
168KB

MD5
0765714af4a1af896abf2023156a842a

SHA1
ecf4726d6c80c0f13ce5a9b03783aeeccf56e9b8

SHA256
8de9c7210a9bf61c585d997f1e0b067f10e4d03bb6e12c080d25c8182bf0d071

SHA512
740d43a99f495163fa4eb73a51b15057ac97197a4cd37d0fbcbf1416258344a6f865a0e9f8a1920d880748a2e7350359d36a17aa94b059bf3e371bc4b4f424a8

Download Submit
C:\Windows\{A890371D-60D1-449c-97D3-04B80368A8EF}.exe

Filesize
168KB

MD5
0765714af4a1af896abf2023156a842a

SHA1
ecf4726d6c80c0f13ce5a9b03783aeeccf56e9b8

SHA256
8de9c7210a9bf61c585d997f1e0b067f10e4d03bb6e12c080d25c8182bf0d071

SHA512
740d43a99f495163fa4eb73a51b15057ac97197a4cd37d0fbcbf1416258344a6f865a0e9f8a1920d880748a2e7350359d36a17aa94b059bf3e371bc4b4f424a8

Download Submit
C:\Windows\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe

Filesize
168KB

MD5
9c5ab80244c91b9996801f6713912432

SHA1
564b45c1ff45bc795209ae15b144f7c897a47793

SHA256
4ec1d4a6aa2ea297ebee95e2b5a0aaa12e3f23357200abfb686f4c221c0245f8

SHA512
188f8805a979baf11b416dcd34acd4b20b398365a727f31158a246095b97f2656ab0dcf936922240ffafce4d3b487b4d7f8d46b2e5e63421fb750abf5e13ef49

Download Submit
C:\Windows\{AB7683EE-DD9C-4f01-BF0B-30C51DB08DE4}.exe

Filesize
168KB

MD5
9c5ab80244c91b9996801f6713912432

SHA1
564b45c1ff45bc795209ae15b144f7c897a47793

SHA256
4ec1d4a6aa2ea297ebee95e2b5a0aaa12e3f23357200abfb686f4c221c0245f8

SHA512
188f8805a979baf11b416dcd34acd4b20b398365a727f31158a246095b97f2656ab0dcf936922240ffafce4d3b487b4d7f8d46b2e5e63421fb750abf5e13ef49

Download Submit
C:\Windows\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe

Filesize
168KB

MD5
029f37772ef8c23c2c6976f2316c3d43

SHA1
bcdfda70d9bd0063b8e245ad5aec015c67b226af

SHA256
184b5db6db81171c8e36c1f833c337c9eddab711c96f174ab66b9ba8e811f35d

SHA512
8adaf55d710ac3a09aa7378468a277b152e9628a639f65278606effd1850548cb2f468dfd9177eb2b7c712015f014e3aee050ddab02c76265e844a3816066277

Download Submit
C:\Windows\{B13634A5-133D-4127-A829-2D8EE2E958C0}.exe

Filesize
168KB

MD5
029f37772ef8c23c2c6976f2316c3d43

SHA1
bcdfda70d9bd0063b8e245ad5aec015c67b226af

SHA256
184b5db6db81171c8e36c1f833c337c9eddab711c96f174ab66b9ba8e811f35d

SHA512
8adaf55d710ac3a09aa7378468a277b152e9628a639f65278606effd1850548cb2f468dfd9177eb2b7c712015f014e3aee050ddab02c76265e844a3816066277

Download Submit
C:\Windows\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe

Filesize
168KB

MD5
7d293fb6b05e43d8211e2c605767cd6e

SHA1
8d0a4c8b59bfcfd757f667e488ad073d71557423

SHA256
a312e869cc130da79a469da371fecf9ba097e93f8f04276d45152a832693336c

SHA512
4f066f2a1c7bfd2a99f56015e3c3a708256378d3da252fd9981f79a7e033197b88469f7d22ece547d6b05c549e95ab87211876ddd2a3610693fddeddfe9f6d89

Download Submit
C:\Windows\{B70282C4-53D9-4c35-A092-4B2BB8FF7BDF}.exe

Filesize
168KB

MD5
7d293fb6b05e43d8211e2c605767cd6e

SHA1
8d0a4c8b59bfcfd757f667e488ad073d71557423

SHA256
a312e869cc130da79a469da371fecf9ba097e93f8f04276d45152a832693336c

SHA512
4f066f2a1c7bfd2a99f56015e3c3a708256378d3da252fd9981f79a7e033197b88469f7d22ece547d6b05c549e95ab87211876ddd2a3610693fddeddfe9f6d89

Download Submit