a3e57695f842c8ba13d1cf0d317ef680c9456992a65750ee180acc3d62d5964b

Analysis

max time kernel
146s
max time network
33s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c0760e7f0019dexeexeexeex.exe
Size

204KB
MD5

7c0760e7f0019de51fc0c45edf3fdc2b
SHA1

31351594293a362d662fb56718096e0c7a014783
SHA256

a3e57695f842c8ba13d1cf0d317ef680c9456992a65750ee180acc3d62d5964b
SHA512

333d06be8c459bd3e55d9a0a2fa702ac88b4e70fb5d96a936b4edb6c6464dee3b13042e01c0e6027cec0d882303486f378c20966c74dd407bba2a3a855ca84ff
SSDEEP

1536:1EGh0oJl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oJl1OPOe2MUVg3Ve+rXfMUy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA16C9C6-B479-4552-98DA-E79F76141352}\stubpath = "C:\\Windows\\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe"	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}\stubpath = "C:\\Windows\\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe"	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}\stubpath = "C:\\Windows\\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe"	{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA16C9C6-B479-4552-98DA-E79F76141352}	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}\stubpath = "C:\\Windows\\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe"	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}\stubpath = "C:\\Windows\\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe"	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{993C2FAF-A107-4153-A9A3-090E371B6D55}	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}	{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF997F7A-880C-42d5-ADA0-EE194924B17E}\stubpath = "C:\\Windows\\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe"	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DF997F7A-880C-42d5-ADA0-EE194924B17E}	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{993C2FAF-A107-4153-A9A3-090E371B6D55}\stubpath = "C:\\Windows\\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe"	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}\stubpath = "C:\\Windows\\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe"	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BF57885-3D3E-4cde-8423-1C42A79151B4}\stubpath = "C:\\Windows\\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe"	7c0760e7f0019dexeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{524E9434-B741-4e66-8BF3-0592E0BF4E96}	{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}	{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}	{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}\stubpath = "C:\\Windows\\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe"	{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E8017B8-FC0A-4767-A58D-18D385976D93}\stubpath = "C:\\Windows\\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe"	{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5E8017B8-FC0A-4767-A58D-18D385976D93}	{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{524E9434-B741-4e66-8BF3-0592E0BF4E96}\stubpath = "C:\\Windows\\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe"	{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}\stubpath = "C:\\Windows\\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe"	{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0BF57885-3D3E-4cde-8423-1C42A79151B4}	7c0760e7f0019dexeexeexeex.exe

Deletes itself 1 IoCs

pid	Process
3040	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
2420	{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
2688	{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
2568	{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
2364	{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
2488	{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
2572	{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
File created	C:\Windows\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
File created	C:\Windows\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe	{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
File created	C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	7c0760e7f0019dexeexeexeex.exe
File created	C:\Windows\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
File created	C:\Windows\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
File created	C:\Windows\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
File created	C:\Windows\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
File created	C:\Windows\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe	{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
File created	C:\Windows\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe	{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
File created	C:\Windows\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe	{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
File created	C:\Windows\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
File created	C:\Windows\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe	{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	900	7c0760e7f0019dexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
Token: SeIncBasePriorityPrivilege	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
Token: SeIncBasePriorityPrivilege	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
Token: SeIncBasePriorityPrivilege	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
Token: SeIncBasePriorityPrivilege	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
Token: SeIncBasePriorityPrivilege	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
Token: SeIncBasePriorityPrivilege	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
Token: SeIncBasePriorityPrivilege	2420	{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
Token: SeIncBasePriorityPrivilege	2688	{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
Token: SeIncBasePriorityPrivilege	2568	{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
Token: SeIncBasePriorityPrivilege	2364	{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
Token: SeIncBasePriorityPrivilege	2488	{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2332	900	7c0760e7f0019dexeexeexeex.exe	28
PID 900 wrote to memory of 2332	900	7c0760e7f0019dexeexeexeex.exe	28
PID 900 wrote to memory of 2332	900	7c0760e7f0019dexeexeexeex.exe	28
PID 900 wrote to memory of 2332	900	7c0760e7f0019dexeexeexeex.exe	28
PID 900 wrote to memory of 3040	900	7c0760e7f0019dexeexeexeex.exe	29
PID 900 wrote to memory of 3040	900	7c0760e7f0019dexeexeexeex.exe	29
PID 900 wrote to memory of 3040	900	7c0760e7f0019dexeexeexeex.exe	29
PID 900 wrote to memory of 3040	900	7c0760e7f0019dexeexeexeex.exe	29
PID 2332 wrote to memory of 1596	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	30
PID 2332 wrote to memory of 1596	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	30
PID 2332 wrote to memory of 1596	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	30
PID 2332 wrote to memory of 1596	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	30
PID 2332 wrote to memory of 1156	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	31
PID 2332 wrote to memory of 1156	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	31
PID 2332 wrote to memory of 1156	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	31
PID 2332 wrote to memory of 1156	2332	{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe	31
PID 1596 wrote to memory of 2252	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	32
PID 1596 wrote to memory of 2252	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	32
PID 1596 wrote to memory of 2252	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	32
PID 1596 wrote to memory of 2252	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	32
PID 1596 wrote to memory of 2956	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	33
PID 1596 wrote to memory of 2956	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	33
PID 1596 wrote to memory of 2956	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	33
PID 1596 wrote to memory of 2956	1596	{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe	33
PID 2252 wrote to memory of 3032	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	34
PID 2252 wrote to memory of 3032	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	34
PID 2252 wrote to memory of 3032	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	34
PID 2252 wrote to memory of 3032	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	34
PID 2252 wrote to memory of 2940	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	35
PID 2252 wrote to memory of 2940	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	35
PID 2252 wrote to memory of 2940	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	35
PID 2252 wrote to memory of 2940	2252	{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe	35
PID 3032 wrote to memory of 1264	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	36
PID 3032 wrote to memory of 1264	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	36
PID 3032 wrote to memory of 1264	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	36
PID 3032 wrote to memory of 1264	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	36
PID 3032 wrote to memory of 1688	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	37
PID 3032 wrote to memory of 1688	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	37
PID 3032 wrote to memory of 1688	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	37
PID 3032 wrote to memory of 1688	3032	{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe	37
PID 1264 wrote to memory of 2084	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	38
PID 1264 wrote to memory of 2084	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	38
PID 1264 wrote to memory of 2084	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	38
PID 1264 wrote to memory of 2084	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	38
PID 1264 wrote to memory of 1288	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	39
PID 1264 wrote to memory of 1288	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	39
PID 1264 wrote to memory of 1288	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	39
PID 1264 wrote to memory of 1288	1264	{DA16C9C6-B479-4552-98DA-E79F76141352}.exe	39
PID 2084 wrote to memory of 2128	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	40
PID 2084 wrote to memory of 2128	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	40
PID 2084 wrote to memory of 2128	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	40
PID 2084 wrote to memory of 2128	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	40
PID 2084 wrote to memory of 1500	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	41
PID 2084 wrote to memory of 1500	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	41
PID 2084 wrote to memory of 1500	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	41
PID 2084 wrote to memory of 1500	2084	{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe	41
PID 2128 wrote to memory of 2420	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	42
PID 2128 wrote to memory of 2420	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	42
PID 2128 wrote to memory of 2420	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	42
PID 2128 wrote to memory of 2420	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	42
PID 2128 wrote to memory of 2092	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	43
PID 2128 wrote to memory of 2092	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	43
PID 2128 wrote to memory of 2092	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	43
PID 2128 wrote to memory of 2092	2128	{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe	43

C:\Users\Admin\AppData\Local\Temp\7c0760e7f0019dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\7c0760e7f0019dexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
  C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
    C:\Windows\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
      C:\Windows\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
        
        C:\Windows\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
        
        C:\Windows\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
        
        C:\Windows\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
        
        C:\Windows\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
        
        C:\Windows\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Windows\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
        
        C:\Windows\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
        
        C:\Windows\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
        
        C:\Windows\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
        
        C:\Windows\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
        
        C:\Windows\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
        
        C:\Windows\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe
        
        C:\Windows\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe
        14⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F1AB9~1.EXE > nul
        14⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1D662~1.EXE > nul
        13⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{524E9~1.EXE > nul
        12⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5E801~1.EXE > nul
        11⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6DD79~1.EXE > nul
        10⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AEE6B~1.EXE > nul
        9⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{993C2~1.EXE > nul
        8⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA16C~1.EXE > nul
        7⤵
        
        PID:1288
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9C523~1.EXE > nul
        6⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD2D5~1.EXE > nul
        5⤵
        
        PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DF997~1.EXE > nul
      4⤵
      PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0BF57~1.EXE > nul
    3⤵
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7C0760~1.EXE > nul
  2⤵
  - Deletes itself
  PID:3040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe

Filesize
204KB

MD5
c86b2b811b164f170724c5ad6e680289

SHA1
03d5994c738908edac69d9a9f7e0ecbcb3fa9ca9

SHA256
d1ce1acae14d01cf61a620868653c7ca5a8385493858b0adcede16b2522717d8

SHA512
746323e838db6f2205e820cee84894348bf85df66ae5c4a0d298b767bc45f6d87cfa8e86f8f2c30ff606ba063a0f62cbc60b22a8d4f3157f8a4e3165928b7f83

Download Submit
C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe

Filesize
204KB

MD5
c86b2b811b164f170724c5ad6e680289

SHA1
03d5994c738908edac69d9a9f7e0ecbcb3fa9ca9

SHA256
d1ce1acae14d01cf61a620868653c7ca5a8385493858b0adcede16b2522717d8

SHA512
746323e838db6f2205e820cee84894348bf85df66ae5c4a0d298b767bc45f6d87cfa8e86f8f2c30ff606ba063a0f62cbc60b22a8d4f3157f8a4e3165928b7f83

Download Submit
C:\Windows\{0BF57885-3D3E-4cde-8423-1C42A79151B4}.exe

Filesize
204KB

MD5
c86b2b811b164f170724c5ad6e680289

SHA1
03d5994c738908edac69d9a9f7e0ecbcb3fa9ca9

SHA256
d1ce1acae14d01cf61a620868653c7ca5a8385493858b0adcede16b2522717d8

SHA512
746323e838db6f2205e820cee84894348bf85df66ae5c4a0d298b767bc45f6d87cfa8e86f8f2c30ff606ba063a0f62cbc60b22a8d4f3157f8a4e3165928b7f83

Download Submit
C:\Windows\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe

Filesize
204KB

MD5
51527971457388dc3772f01b8b12ac6b

SHA1
c9f30075805e809bccc70c5978db54649047650c

SHA256
e0c742fbaaa277fbf66c5bd7622a54770e5b3ec64ea557ef075700af4b8b308a

SHA512
8614f10360e644b6ed1325ca60973fe7761dbde099bb7342ffa3138459e8464eee734c358b3e3d754875c76b8fd2b01fb1786d612f4b97e2fa6d39e63c684f55

Download Submit
C:\Windows\{1D662DA3-C9CA-4ffd-9681-B39971E9396D}.exe

Filesize
204KB

MD5
51527971457388dc3772f01b8b12ac6b

SHA1
c9f30075805e809bccc70c5978db54649047650c

SHA256
e0c742fbaaa277fbf66c5bd7622a54770e5b3ec64ea557ef075700af4b8b308a

SHA512
8614f10360e644b6ed1325ca60973fe7761dbde099bb7342ffa3138459e8464eee734c358b3e3d754875c76b8fd2b01fb1786d612f4b97e2fa6d39e63c684f55

Download Submit
C:\Windows\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe

Filesize
204KB

MD5
2de88e5cb3e3a7082a30d41c4dac6681

SHA1
48d88461c657a247cab1f912cc9618e6e18172e4

SHA256
c905d721328a22059d7ab71842b7f9be4e14123c8aa997f5783064df9b4f0177

SHA512
004c7e516b3b6e1ddbf684db57805df61e438ca692f26a8dcb65262c685c4f013ecb438dc1483b82d442c1a20455f6a8a2ca7cd23f63f31b603ad8a3fef7f179

Download Submit
C:\Windows\{524E9434-B741-4e66-8BF3-0592E0BF4E96}.exe

Filesize
204KB

MD5
2de88e5cb3e3a7082a30d41c4dac6681

SHA1
48d88461c657a247cab1f912cc9618e6e18172e4

SHA256
c905d721328a22059d7ab71842b7f9be4e14123c8aa997f5783064df9b4f0177

SHA512
004c7e516b3b6e1ddbf684db57805df61e438ca692f26a8dcb65262c685c4f013ecb438dc1483b82d442c1a20455f6a8a2ca7cd23f63f31b603ad8a3fef7f179

Download Submit
C:\Windows\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe

Filesize
204KB

MD5
e4f128fc47553a51a1061d7244d5688f

SHA1
afedb8ad1d117797c6391d38f453531759c1b7c9

SHA256
61a2f8b471313e61eba3224f307412e2e8e2c3a66cdd303cf4f8b67bb5f370cd

SHA512
5b8d5db498680ff885c5537157ca30c324f9285a22e26e669fac4a6bd905b91b8b98e5c1c1d9a7a1b9122557720b13d2b1d0d8abfb8c869a3ce33e86346249fb

Download Submit
C:\Windows\{5E8017B8-FC0A-4767-A58D-18D385976D93}.exe

Filesize
204KB

MD5
e4f128fc47553a51a1061d7244d5688f

SHA1
afedb8ad1d117797c6391d38f453531759c1b7c9

SHA256
61a2f8b471313e61eba3224f307412e2e8e2c3a66cdd303cf4f8b67bb5f370cd

SHA512
5b8d5db498680ff885c5537157ca30c324f9285a22e26e669fac4a6bd905b91b8b98e5c1c1d9a7a1b9122557720b13d2b1d0d8abfb8c869a3ce33e86346249fb

Download Submit
C:\Windows\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe

Filesize
204KB

MD5
be1f5cdeb424dd182836a7f4c787d67b

SHA1
e7b68c75da19b87771324b7bee40ef1bd068f84f

SHA256
a9aec6148d1e445ec4e76e00e3f3328c76c9e7c2ec2a6728b2ae9b6a3dcac440

SHA512
8e9e46f3bf6b961ee83c8d08da6d64526e440f259efdfa1f4db7b638538bf37c7fa51cfcfd5ef46a76498f226230c4c235f4b2f07526978b0dd2a00b6e80458f

Download Submit
C:\Windows\{6DD79EBE-C6E7-46f8-B04F-ABE490C0E8E8}.exe

Filesize
204KB

MD5
be1f5cdeb424dd182836a7f4c787d67b

SHA1
e7b68c75da19b87771324b7bee40ef1bd068f84f

SHA256
a9aec6148d1e445ec4e76e00e3f3328c76c9e7c2ec2a6728b2ae9b6a3dcac440

SHA512
8e9e46f3bf6b961ee83c8d08da6d64526e440f259efdfa1f4db7b638538bf37c7fa51cfcfd5ef46a76498f226230c4c235f4b2f07526978b0dd2a00b6e80458f

Download Submit
C:\Windows\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe

Filesize
204KB

MD5
f0005ee68a0c5808a1f17d09025e73af

SHA1
e9cd65cc1fdb4f7e953e6236b22451e1b19219a5

SHA256
f43b2cc65e474e675594d788539d1b7264d4741b98c755cce328c7a42db98f99

SHA512
7f9f9f2606e4c0e4eaaa49ba1c11cd10fc3a1f39274c81b9360f012860e89c125d43a79228a31dad68d915abf20c207e3b221d0c0eaeda3dde4407b287e37b2d

Download Submit
C:\Windows\{993C2FAF-A107-4153-A9A3-090E371B6D55}.exe

Filesize
204KB

MD5
f0005ee68a0c5808a1f17d09025e73af

SHA1
e9cd65cc1fdb4f7e953e6236b22451e1b19219a5

SHA256
f43b2cc65e474e675594d788539d1b7264d4741b98c755cce328c7a42db98f99

SHA512
7f9f9f2606e4c0e4eaaa49ba1c11cd10fc3a1f39274c81b9360f012860e89c125d43a79228a31dad68d915abf20c207e3b221d0c0eaeda3dde4407b287e37b2d

Download Submit
C:\Windows\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe

Filesize
204KB

MD5
c32e5ec368e6ba10e75e86d92f537f62

SHA1
ef163336da033cb65e6968229f127e3acf4ff750

SHA256
6534109a31a0adbbdba2f4db47a69f7b9461fca01ef1864b164ecac0fac2e7e2

SHA512
972dd63f161b94f1a097297a0a5142e12d78878d6ed74c5658f35a73168a92f19669b39d901fcb891cd18763939302052dd825c807398e8c167b492876ee0728

Download Submit
C:\Windows\{9C5232DB-1AE0-47f5-A0DE-65F952B2A567}.exe

Filesize
204KB

MD5
c32e5ec368e6ba10e75e86d92f537f62

SHA1
ef163336da033cb65e6968229f127e3acf4ff750

SHA256
6534109a31a0adbbdba2f4db47a69f7b9461fca01ef1864b164ecac0fac2e7e2

SHA512
972dd63f161b94f1a097297a0a5142e12d78878d6ed74c5658f35a73168a92f19669b39d901fcb891cd18763939302052dd825c807398e8c167b492876ee0728

Download Submit
C:\Windows\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe

Filesize
204KB

MD5
9dc4d94ffaf8d91d7c916ee550509d48

SHA1
10764a2b3bbcef85e04da4f5f8818e9f8602056a

SHA256
09274316ab9bec837f3cbeb128e6a4f3d887f4a43eab8c1bd8f7bbb5ac73f01a

SHA512
a5056b3a110033f6ad0df6b32d1b4eb158398e4c5eea3b055629f06f5a4d9c2d8c62d9aa59c5069dd5b5fa3bac61cc0f3d7046a7ef1ed85e5313a49a9055eb6a

Download Submit
C:\Windows\{AEE6B2DF-6926-439c-AA32-E3BCBD4A2DB8}.exe

Filesize
204KB

MD5
9dc4d94ffaf8d91d7c916ee550509d48

SHA1
10764a2b3bbcef85e04da4f5f8818e9f8602056a

SHA256
09274316ab9bec837f3cbeb128e6a4f3d887f4a43eab8c1bd8f7bbb5ac73f01a

SHA512
a5056b3a110033f6ad0df6b32d1b4eb158398e4c5eea3b055629f06f5a4d9c2d8c62d9aa59c5069dd5b5fa3bac61cc0f3d7046a7ef1ed85e5313a49a9055eb6a

Download Submit
C:\Windows\{C8EFFCA3-BCB0-430f-ACEB-FE2E18273AFB}.exe

Filesize
204KB

MD5
c256b33313577412bb7109a468ea373c

SHA1
1c58ab881eea7c7d1c65a2db825b76418fae9c15

SHA256
34304cb53a550735e16616e977ace717588d5fd532f09db3748168129dd848d3

SHA512
584ccf340b167e0def1e0fb5ab0430d876c2fbfdb36038f2a219c8b48c0537f59286b472eb0198cf4158caf3968137f8442dad59955648f7f86b527f62c5cdcb

Download Submit
C:\Windows\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe

Filesize
204KB

MD5
987992c06783c2ce0c7ffd4ba38d05f4

SHA1
314d95eddc19ec0aff733bac2aa9e26b1e06175f

SHA256
1bb54a014fd6fe8ee6d729cf5028b89fe36f72b1695dc451b551326b542ced2b

SHA512
e627fe223ee871fc5b8832d9694600b447050abd771449f1071f8d65df8af88f362d6e8354b88039aeaf3cad5a1b37632176974eb353f90802e3df4ac0d8014b

Download Submit
C:\Windows\{CD2D54DD-9F5A-4c7d-BC33-C84C279AEE6F}.exe

Filesize
204KB

MD5
987992c06783c2ce0c7ffd4ba38d05f4

SHA1
314d95eddc19ec0aff733bac2aa9e26b1e06175f

SHA256
1bb54a014fd6fe8ee6d729cf5028b89fe36f72b1695dc451b551326b542ced2b

SHA512
e627fe223ee871fc5b8832d9694600b447050abd771449f1071f8d65df8af88f362d6e8354b88039aeaf3cad5a1b37632176974eb353f90802e3df4ac0d8014b

Download Submit
C:\Windows\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe

Filesize
204KB

MD5
c5787c605bf14c6fc19fa2258deead61

SHA1
716e1addcf86707e6d8d51f69df59bb399dd7400

SHA256
a3e4115a110e6f7cc1bcbe10f617ba9e85d629ec09839c2260a9ffefb60b504b

SHA512
68d61f0203e9528e2008265c1001fc930fed35baa80c3484e66f5983b5bddf1ede3df06cb15d49bd7de27a853cb4934da001e211935d62f3de07ddd94a584e14

Download Submit
C:\Windows\{DA16C9C6-B479-4552-98DA-E79F76141352}.exe

Filesize
204KB

MD5
c5787c605bf14c6fc19fa2258deead61

SHA1
716e1addcf86707e6d8d51f69df59bb399dd7400

SHA256
a3e4115a110e6f7cc1bcbe10f617ba9e85d629ec09839c2260a9ffefb60b504b

SHA512
68d61f0203e9528e2008265c1001fc930fed35baa80c3484e66f5983b5bddf1ede3df06cb15d49bd7de27a853cb4934da001e211935d62f3de07ddd94a584e14

Download Submit
C:\Windows\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe

Filesize
204KB

MD5
5767bd3e9f91e350d2ce3b453d8eaea8

SHA1
55e4da8a8dcccaaf5f0aa61dee1f8b36665bc9cf

SHA256
ee457e8a1e88ed007ff6bae4035ff9764093450314fcfa4877fbf8830d406118

SHA512
22fa36d371b42acade9341c411e0d5b77c4cdd887265bbc1796ad58153932b56f9992f6d10200122dba4a917c295a3cd044c869971eb38510ff3e7a08c011d84

Download Submit
C:\Windows\{DF997F7A-880C-42d5-ADA0-EE194924B17E}.exe

Filesize
204KB

MD5
5767bd3e9f91e350d2ce3b453d8eaea8

SHA1
55e4da8a8dcccaaf5f0aa61dee1f8b36665bc9cf

SHA256
ee457e8a1e88ed007ff6bae4035ff9764093450314fcfa4877fbf8830d406118

SHA512
22fa36d371b42acade9341c411e0d5b77c4cdd887265bbc1796ad58153932b56f9992f6d10200122dba4a917c295a3cd044c869971eb38510ff3e7a08c011d84

Download Submit
C:\Windows\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe

Filesize
204KB

MD5
6bcdbd99447f86f861527bc4bfab9b1e

SHA1
380baa528e3e45b771501d596b015673daa8c59d

SHA256
2f4bf9b69683c4df2b3df598e72d8ff299801700eca1cf0c946c25ced043f56e

SHA512
aa70ffdd0d44464ce0e61ac92f3869a155322f88b96e1db1a824d3472d7acb0890dbbffc5142c88e6db7a02221499f0c5d029869062a0eec70344341d7db22bf

Download Submit
C:\Windows\{F1AB9CC7-FF54-4aac-B1F0-FB89DC78743F}.exe

Filesize
204KB

MD5
6bcdbd99447f86f861527bc4bfab9b1e

SHA1
380baa528e3e45b771501d596b015673daa8c59d

SHA256
2f4bf9b69683c4df2b3df598e72d8ff299801700eca1cf0c946c25ced043f56e

SHA512
aa70ffdd0d44464ce0e61ac92f3869a155322f88b96e1db1a824d3472d7acb0890dbbffc5142c88e6db7a02221499f0c5d029869062a0eec70344341d7db22bf

Download Submit