df35c647aecd640e3051efef55f22997a1ad172a48c0a7d12fbc7aabb9ff7fc5

Analysis

max time kernel
151s
max time network
33s
platform
windows7_x64
resource
win7-20230705-en
resource tags

arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af067a0577994dexeexeexeex.exe
Size

408KB
MD5

af067a0577994d6f1f282d6cec71c382
SHA1

88482045ea454daf9ade8023c2e002c0786cff14
SHA256

df35c647aecd640e3051efef55f22997a1ad172a48c0a7d12fbc7aabb9ff7fc5
SHA512

862a7b925ed2a57e33a48037d0bb8f82e4d22e1a5f580b9d334e1f71489ce90bb771aabcb72f4cf33432654566d7baef4ff030595d993baf2ee6f00889a3def6
SSDEEP

3072:CEGh0owl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGaldOe2MUVg3vTeKcAEciTBqr3jy

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC004721-7537-47df-BB0F-B59257E49C53}	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3963C901-A60C-4b9f-843B-8276408CC37D}	{EC004721-7537-47df-BB0F-B59257E49C53}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DE74FA7-0563-475e-AD56-47C014DA366D}	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25500E85-45EF-4372-8623-943929316201}	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D7FB21D-C17C-472d-9537-52099ABE1C08}\stubpath = "C:\\Windows\\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe"	{25500E85-45EF-4372-8623-943929316201}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4400E6A6-1A6A-4f61-A683-60464378732E}\stubpath = "C:\\Windows\\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe"	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}\stubpath = "C:\\Windows\\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe"	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{085CF33B-851B-4fe7-B616-BAC662398171}\stubpath = "C:\\Windows\\{085CF33B-851B-4fe7-B616-BAC662398171}.exe"	{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72753836-27E3-4244-A535-C28E9E5B5821}	{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68068789-D4A2-481b-B06C-8466169D8BBB}\stubpath = "C:\\Windows\\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe"	{085CF33B-851B-4fe7-B616-BAC662398171}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}	af067a0577994dexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}\stubpath = "C:\\Windows\\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe"	af067a0577994dexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{25500E85-45EF-4372-8623-943929316201}\stubpath = "C:\\Windows\\{25500E85-45EF-4372-8623-943929316201}.exe"	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4400E6A6-1A6A-4f61-A683-60464378732E}	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3963C901-A60C-4b9f-843B-8276408CC37D}\stubpath = "C:\\Windows\\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe"	{EC004721-7537-47df-BB0F-B59257E49C53}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1DE74FA7-0563-475e-AD56-47C014DA366D}\stubpath = "C:\\Windows\\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe"	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}	{68068789-D4A2-481b-B06C-8466169D8BBB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{72753836-27E3-4244-A535-C28E9E5B5821}\stubpath = "C:\\Windows\\{72753836-27E3-4244-A535-C28E9E5B5821}.exe"	{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}	{72753836-27E3-4244-A535-C28E9E5B5821}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}\stubpath = "C:\\Windows\\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe"	{72753836-27E3-4244-A535-C28E9E5B5821}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6D7FB21D-C17C-472d-9537-52099ABE1C08}	{25500E85-45EF-4372-8623-943929316201}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EC004721-7537-47df-BB0F-B59257E49C53}\stubpath = "C:\\Windows\\{EC004721-7537-47df-BB0F-B59257E49C53}.exe"	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{085CF33B-851B-4fe7-B616-BAC662398171}	{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{68068789-D4A2-481b-B06C-8466169D8BBB}	{085CF33B-851B-4fe7-B616-BAC662398171}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}\stubpath = "C:\\Windows\\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe"	{68068789-D4A2-481b-B06C-8466169D8BBB}.exe

Deletes itself 1 IoCs

pid	Process
2096	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
2116	{25500E85-45EF-4372-8623-943929316201}.exe
764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe
2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
2664	{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
2084	{085CF33B-851B-4fe7-B616-BAC662398171}.exe
2740	{68068789-D4A2-481b-B06C-8466169D8BBB}.exe
2676	{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
2868	{72753836-27E3-4244-A535-C28E9E5B5821}.exe
2652	{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe	{72753836-27E3-4244-A535-C28E9E5B5821}.exe
File created	C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	af067a0577994dexeexeexeex.exe
File created	C:\Windows\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
File created	C:\Windows\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
File created	C:\Windows\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
File created	C:\Windows\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe	{085CF33B-851B-4fe7-B616-BAC662398171}.exe
File created	C:\Windows\{72753836-27E3-4244-A535-C28E9E5B5821}.exe	{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
File created	C:\Windows\{25500E85-45EF-4372-8623-943929316201}.exe	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
File created	C:\Windows\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	{25500E85-45EF-4372-8623-943929316201}.exe
File created	C:\Windows\{EC004721-7537-47df-BB0F-B59257E49C53}.exe	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
File created	C:\Windows\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	{EC004721-7537-47df-BB0F-B59257E49C53}.exe
File created	C:\Windows\{085CF33B-851B-4fe7-B616-BAC662398171}.exe	{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
File created	C:\Windows\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe	{68068789-D4A2-481b-B06C-8466169D8BBB}.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2992	af067a0577994dexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
Token: SeIncBasePriorityPrivilege	2116	{25500E85-45EF-4372-8623-943929316201}.exe
Token: SeIncBasePriorityPrivilege	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
Token: SeIncBasePriorityPrivilege	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
Token: SeIncBasePriorityPrivilege	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
Token: SeIncBasePriorityPrivilege	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe
Token: SeIncBasePriorityPrivilege	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
Token: SeIncBasePriorityPrivilege	2664	{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
Token: SeIncBasePriorityPrivilege	2084	{085CF33B-851B-4fe7-B616-BAC662398171}.exe
Token: SeIncBasePriorityPrivilege	2740	{68068789-D4A2-481b-B06C-8466169D8BBB}.exe
Token: SeIncBasePriorityPrivilege	2676	{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
Token: SeIncBasePriorityPrivilege	2868	{72753836-27E3-4244-A535-C28E9E5B5821}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2876	2992	af067a0577994dexeexeexeex.exe	28
PID 2992 wrote to memory of 2876	2992	af067a0577994dexeexeexeex.exe	28
PID 2992 wrote to memory of 2876	2992	af067a0577994dexeexeexeex.exe	28
PID 2992 wrote to memory of 2876	2992	af067a0577994dexeexeexeex.exe	28
PID 2992 wrote to memory of 2096	2992	af067a0577994dexeexeexeex.exe	29
PID 2992 wrote to memory of 2096	2992	af067a0577994dexeexeexeex.exe	29
PID 2992 wrote to memory of 2096	2992	af067a0577994dexeexeexeex.exe	29
PID 2992 wrote to memory of 2096	2992	af067a0577994dexeexeexeex.exe	29
PID 2876 wrote to memory of 2116	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	30
PID 2876 wrote to memory of 2116	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	30
PID 2876 wrote to memory of 2116	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	30
PID 2876 wrote to memory of 2116	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	30
PID 2876 wrote to memory of 336	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	31
PID 2876 wrote to memory of 336	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	31
PID 2876 wrote to memory of 336	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	31
PID 2876 wrote to memory of 336	2876	{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe	31
PID 2116 wrote to memory of 764	2116	{25500E85-45EF-4372-8623-943929316201}.exe	32
PID 2116 wrote to memory of 764	2116	{25500E85-45EF-4372-8623-943929316201}.exe	32
PID 2116 wrote to memory of 764	2116	{25500E85-45EF-4372-8623-943929316201}.exe	32
PID 2116 wrote to memory of 764	2116	{25500E85-45EF-4372-8623-943929316201}.exe	32
PID 2116 wrote to memory of 1608	2116	{25500E85-45EF-4372-8623-943929316201}.exe	33
PID 2116 wrote to memory of 1608	2116	{25500E85-45EF-4372-8623-943929316201}.exe	33
PID 2116 wrote to memory of 1608	2116	{25500E85-45EF-4372-8623-943929316201}.exe	33
PID 2116 wrote to memory of 1608	2116	{25500E85-45EF-4372-8623-943929316201}.exe	33
PID 764 wrote to memory of 2076	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	34
PID 764 wrote to memory of 2076	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	34
PID 764 wrote to memory of 2076	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	34
PID 764 wrote to memory of 2076	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	34
PID 764 wrote to memory of 1112	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	35
PID 764 wrote to memory of 1112	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	35
PID 764 wrote to memory of 1112	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	35
PID 764 wrote to memory of 1112	764	{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe	35
PID 2076 wrote to memory of 2172	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	36
PID 2076 wrote to memory of 2172	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	36
PID 2076 wrote to memory of 2172	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	36
PID 2076 wrote to memory of 2172	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	36
PID 2076 wrote to memory of 2360	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	37
PID 2076 wrote to memory of 2360	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	37
PID 2076 wrote to memory of 2360	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	37
PID 2076 wrote to memory of 2360	2076	{4400E6A6-1A6A-4f61-A683-60464378732E}.exe	37
PID 2172 wrote to memory of 1272	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	38
PID 2172 wrote to memory of 1272	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	38
PID 2172 wrote to memory of 1272	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	38
PID 2172 wrote to memory of 1272	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	38
PID 2172 wrote to memory of 1916	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	39
PID 2172 wrote to memory of 1916	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	39
PID 2172 wrote to memory of 1916	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	39
PID 2172 wrote to memory of 1916	2172	{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe	39
PID 1272 wrote to memory of 2148	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	40
PID 1272 wrote to memory of 2148	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	40
PID 1272 wrote to memory of 2148	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	40
PID 1272 wrote to memory of 2148	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	40
PID 1272 wrote to memory of 2248	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	41
PID 1272 wrote to memory of 2248	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	41
PID 1272 wrote to memory of 2248	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	41
PID 1272 wrote to memory of 2248	1272	{EC004721-7537-47df-BB0F-B59257E49C53}.exe	41
PID 2148 wrote to memory of 2664	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	42
PID 2148 wrote to memory of 2664	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	42
PID 2148 wrote to memory of 2664	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	42
PID 2148 wrote to memory of 2664	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	42
PID 2148 wrote to memory of 3052	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	43
PID 2148 wrote to memory of 3052	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	43
PID 2148 wrote to memory of 3052	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	43
PID 2148 wrote to memory of 3052	2148	{3963C901-A60C-4b9f-843B-8276408CC37D}.exe	43

C:\Users\Admin\AppData\Local\Temp\af067a0577994dexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\af067a0577994dexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
  C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\{25500E85-45EF-4372-8623-943929316201}.exe
    C:\Windows\{25500E85-45EF-4372-8623-943929316201}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
      C:\Windows\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:764
    - - C:\Windows\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
        
        C:\Windows\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
        
        C:\Windows\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\{EC004721-7537-47df-BB0F-B59257E49C53}.exe
        
        C:\Windows\{EC004721-7537-47df-BB0F-B59257E49C53}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
        
        C:\Windows\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
        
        C:\Windows\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Windows\{085CF33B-851B-4fe7-B616-BAC662398171}.exe
        
        C:\Windows\{085CF33B-851B-4fe7-B616-BAC662398171}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe
        
        C:\Windows\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
        
        C:\Windows\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
        
        C:\Windows\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
        
        C:\Windows\{72753836-27E3-4244-A535-C28E9E5B5821}.exe
        
        C:\Windows\{72753836-27E3-4244-A535-C28E9E5B5821}.exe
        13⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Windows\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe
        
        C:\Windows\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe
        14⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{72753~1.EXE > nul
        14⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9803E~1.EXE > nul
        13⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{68068~1.EXE > nul
        12⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{085CF~1.EXE > nul
        11⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1DE74~1.EXE > nul
        10⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3963C~1.EXE > nul
        9⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EC004~1.EXE > nul
        8⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA4EA~1.EXE > nul
        7⤵
        
        PID:1916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4400E~1.EXE > nul
        6⤵
        
        PID:2360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6D7FB~1.EXE > nul
        5⤵
        
        PID:1112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{25500~1.EXE > nul
      4⤵
      PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EC51F~1.EXE > nul
    3⤵
    PID:336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\AF067A~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{085CF33B-851B-4fe7-B616-BAC662398171}.exe

Filesize
408KB

MD5
76f8593489b7821948e645767b568e75

SHA1
20eb0b0f5dc98b06619f5e3dc4462574d5b9ec33

SHA256
194a51568146c4c7722f196be31b195142628b34fdcdb112faf5ecff8d6b6bee

SHA512
f2baeb803831fa5f35a36fa61a6b8f07ffc7c9da8a0596c9a597e9917468649365506101e36bac19a8152a14c99f7127ab6509e2250d5d52b70fa1c023945036

Download Submit
C:\Windows\{085CF33B-851B-4fe7-B616-BAC662398171}.exe

Filesize
408KB

MD5
76f8593489b7821948e645767b568e75

SHA1
20eb0b0f5dc98b06619f5e3dc4462574d5b9ec33

SHA256
194a51568146c4c7722f196be31b195142628b34fdcdb112faf5ecff8d6b6bee

SHA512
f2baeb803831fa5f35a36fa61a6b8f07ffc7c9da8a0596c9a597e9917468649365506101e36bac19a8152a14c99f7127ab6509e2250d5d52b70fa1c023945036

Download Submit
C:\Windows\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe

Filesize
408KB

MD5
d86e92c03f9f56b0041709ac3180bbe6

SHA1
4b16d7d18e805aa39be6f98dbb1ee1ec2b44a1ee

SHA256
a43c3f6df1628702da9cc5900949441c0f87cf8f080edac687c9a73b6753b6e7

SHA512
22ae98e8f4c91816a5d3f783a967f6218a3264d752b203e28001e7689a9b3e36782629c5768c2574228c5f25d71dfe609747b94008fe1b36c93dd28d6aeded25

Download Submit
C:\Windows\{1DE74FA7-0563-475e-AD56-47C014DA366D}.exe

Filesize
408KB

MD5
d86e92c03f9f56b0041709ac3180bbe6

SHA1
4b16d7d18e805aa39be6f98dbb1ee1ec2b44a1ee

SHA256
a43c3f6df1628702da9cc5900949441c0f87cf8f080edac687c9a73b6753b6e7

SHA512
22ae98e8f4c91816a5d3f783a967f6218a3264d752b203e28001e7689a9b3e36782629c5768c2574228c5f25d71dfe609747b94008fe1b36c93dd28d6aeded25

Download Submit
C:\Windows\{25500E85-45EF-4372-8623-943929316201}.exe

Filesize
408KB

MD5
b6342ce9af42bf7fddc8afb5687375e8

SHA1
5fc06be232996d079d828db84a3ee1b739a4f8df

SHA256
1ba897992fe662b0c1d7cc1eda44290a3d1168cbd5c7bca08b2f55dce1a651ce

SHA512
9481d488ec690d54d2914ecbab514bfa336e0d73114089308ad9c2ad3febfbc03fdb1a9bc9df6211de28245f380f3d3811138f70c63692f2a8a3fe4c8c443049

Download Submit
C:\Windows\{25500E85-45EF-4372-8623-943929316201}.exe

Filesize
408KB

MD5
b6342ce9af42bf7fddc8afb5687375e8

SHA1
5fc06be232996d079d828db84a3ee1b739a4f8df

SHA256
1ba897992fe662b0c1d7cc1eda44290a3d1168cbd5c7bca08b2f55dce1a651ce

SHA512
9481d488ec690d54d2914ecbab514bfa336e0d73114089308ad9c2ad3febfbc03fdb1a9bc9df6211de28245f380f3d3811138f70c63692f2a8a3fe4c8c443049

Download Submit
C:\Windows\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe

Filesize
408KB

MD5
926dac02c4b7e9d4d05171954efed8b2

SHA1
9816add66c409e68ec29a5d26ac9ec4780fe282a

SHA256
cf2055bff46f9a40d5e95ee8baf4777fb3e5e51b5ee99d5b5714fe3da5125cdf

SHA512
7bd04ad41e3d373ba511c58347e73ed7c51ae0fef4cee34c61d45e0e81f1ab3da6c6a40d25f8aefbac126c7dfb3562c4d1ec5b745bb53331e9254c91091b19cd

Download Submit
C:\Windows\{3963C901-A60C-4b9f-843B-8276408CC37D}.exe

Filesize
408KB

MD5
926dac02c4b7e9d4d05171954efed8b2

SHA1
9816add66c409e68ec29a5d26ac9ec4780fe282a

SHA256
cf2055bff46f9a40d5e95ee8baf4777fb3e5e51b5ee99d5b5714fe3da5125cdf

SHA512
7bd04ad41e3d373ba511c58347e73ed7c51ae0fef4cee34c61d45e0e81f1ab3da6c6a40d25f8aefbac126c7dfb3562c4d1ec5b745bb53331e9254c91091b19cd

Download Submit
C:\Windows\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe

Filesize
408KB

MD5
3ba02cd5f3b98e4470d339d8e075e683

SHA1
2f6767399eaae466a902bc2015dd88ef8eb150ee

SHA256
7e12417f74eb8896270697f3a3158e0553c5c25f3c73dd3e543e12cc45dbd6ce

SHA512
2d676728924752bce0a79862eb17d2fdb4c44327b033d35dbaf9a065e668df6f1c0817a884fd02b531ffe2b4508c2d85add6139c48ea5a101373ef5815635abe

Download Submit
C:\Windows\{4400E6A6-1A6A-4f61-A683-60464378732E}.exe

Filesize
408KB

MD5
3ba02cd5f3b98e4470d339d8e075e683

SHA1
2f6767399eaae466a902bc2015dd88ef8eb150ee

SHA256
7e12417f74eb8896270697f3a3158e0553c5c25f3c73dd3e543e12cc45dbd6ce

SHA512
2d676728924752bce0a79862eb17d2fdb4c44327b033d35dbaf9a065e668df6f1c0817a884fd02b531ffe2b4508c2d85add6139c48ea5a101373ef5815635abe

Download Submit
C:\Windows\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe

Filesize
408KB

MD5
61dc26c65ab64ea9ca06d553def6c1d3

SHA1
359fb4f159b0e9198b5c76e5c17b84fd11b9ed01

SHA256
07a2c2c77d01f1c162dfeb81356cb9d63b16267f7bff4628c3bf2527846acc38

SHA512
8d6302b4c9b505238fdcb163226d9d61fac4f912439686d205c8b5e1da89d4dac8190add201f599e7fcc9f1ed47def24ee9f992f90be77a77c3636e0c465fdd5

Download Submit
C:\Windows\{68068789-D4A2-481b-B06C-8466169D8BBB}.exe

Filesize
408KB

MD5
61dc26c65ab64ea9ca06d553def6c1d3

SHA1
359fb4f159b0e9198b5c76e5c17b84fd11b9ed01

SHA256
07a2c2c77d01f1c162dfeb81356cb9d63b16267f7bff4628c3bf2527846acc38

SHA512
8d6302b4c9b505238fdcb163226d9d61fac4f912439686d205c8b5e1da89d4dac8190add201f599e7fcc9f1ed47def24ee9f992f90be77a77c3636e0c465fdd5

Download Submit
C:\Windows\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe

Filesize
408KB

MD5
c09384d76e1d30ea0b12a116ffa3dca0

SHA1
32b42f76bc619d544edf7ae420c802cda4a5a1d6

SHA256
60fa1462310d792c95ab4f3a158ceafd6a3f1e127d37302d50ae793c30910c3e

SHA512
9ba084ab4a6dd995512f137e956b0e4d885c3a714327f592b5f55163d5ee781b8a8abe23616f6204f5ff91d1cd36aa983b1880235f0349e0f5432629c30845e2

Download Submit
C:\Windows\{6D7FB21D-C17C-472d-9537-52099ABE1C08}.exe

Filesize
408KB

MD5
c09384d76e1d30ea0b12a116ffa3dca0

SHA1
32b42f76bc619d544edf7ae420c802cda4a5a1d6

SHA256
60fa1462310d792c95ab4f3a158ceafd6a3f1e127d37302d50ae793c30910c3e

SHA512
9ba084ab4a6dd995512f137e956b0e4d885c3a714327f592b5f55163d5ee781b8a8abe23616f6204f5ff91d1cd36aa983b1880235f0349e0f5432629c30845e2

Download Submit
C:\Windows\{72753836-27E3-4244-A535-C28E9E5B5821}.exe

Filesize
408KB

MD5
a25636eecaa7004c675d9608d6973e27

SHA1
fabfd5199aa5f085ebb44d2939e7d85f246e6527

SHA256
6099021f9d65b5254ddaebf47b0ad74b8cf048b79d191da04ade179fc284b3f0

SHA512
ceb54394b8b922a940b752be5a159e417e62d89a1cec3a19cbccfeae36d1079b1d02d818746795580338024342ff16c138236452e8e22b4aac3d20e0f760d3d8

Download Submit
C:\Windows\{72753836-27E3-4244-A535-C28E9E5B5821}.exe

Filesize
408KB

MD5
a25636eecaa7004c675d9608d6973e27

SHA1
fabfd5199aa5f085ebb44d2939e7d85f246e6527

SHA256
6099021f9d65b5254ddaebf47b0ad74b8cf048b79d191da04ade179fc284b3f0

SHA512
ceb54394b8b922a940b752be5a159e417e62d89a1cec3a19cbccfeae36d1079b1d02d818746795580338024342ff16c138236452e8e22b4aac3d20e0f760d3d8

Download Submit
C:\Windows\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe

Filesize
408KB

MD5
e5e7d7301785e74f52ffb50a3ea19009

SHA1
a90ecd0a8be94ad1a539dabfbb1290da0e270f9e

SHA256
7091cc6b4ab5f1de6b131e5d1b42878108878a1ba26ada844b272871b70344aa

SHA512
722ebe580c90a4d8674b87447d2e20e6358746044d92de76f0e3e3fbc137c3b4e5616391b8e9ca66fbb5a58a81a93772e82e82125dbf8fb16ac5bea1107fcb79

Download Submit
C:\Windows\{9803E7F8-5A36-4a0f-BE10-7B5635EFA933}.exe

Filesize
408KB

MD5
e5e7d7301785e74f52ffb50a3ea19009

SHA1
a90ecd0a8be94ad1a539dabfbb1290da0e270f9e

SHA256
7091cc6b4ab5f1de6b131e5d1b42878108878a1ba26ada844b272871b70344aa

SHA512
722ebe580c90a4d8674b87447d2e20e6358746044d92de76f0e3e3fbc137c3b4e5616391b8e9ca66fbb5a58a81a93772e82e82125dbf8fb16ac5bea1107fcb79

Download Submit
C:\Windows\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe

Filesize
408KB

MD5
8736919d9e4b50470c8043c4c907f87e

SHA1
412316e2c6dc4557d0a0f259ae6f21f62975aa70

SHA256
3b89a3b682c51a0c4bb9f1170b16d04ccba3aaef588424cb62cc65d0d0430ece

SHA512
f735b0cb5db2350bdc53a32b60edf951c98dd0bb992fe8f4fe5a5ea98f9b8a88cdba35a6d94921a794bdb8e4cf04f22ae8f82497db5dff45cf9e269f5dfd4ab9

Download Submit
C:\Windows\{CA4EAA6A-8C13-4b0e-90CE-B5EBA054215F}.exe

Filesize
408KB

MD5
8736919d9e4b50470c8043c4c907f87e

SHA1
412316e2c6dc4557d0a0f259ae6f21f62975aa70

SHA256
3b89a3b682c51a0c4bb9f1170b16d04ccba3aaef588424cb62cc65d0d0430ece

SHA512
f735b0cb5db2350bdc53a32b60edf951c98dd0bb992fe8f4fe5a5ea98f9b8a88cdba35a6d94921a794bdb8e4cf04f22ae8f82497db5dff45cf9e269f5dfd4ab9

Download Submit
C:\Windows\{EC004721-7537-47df-BB0F-B59257E49C53}.exe

Filesize
408KB

MD5
a452d9eb0d0c21d719497be31ebaf949

SHA1
433662708bbca73d5665337984c37ae4123c80de

SHA256
e4bde61b5ccf4573abc1d3cad984a36ef60e2d92e3cfb5c878de91fbf5392f50

SHA512
e7bc4b394e29054956764067c05ec77a50ef87e9ec84676043e5f78eef0ae0d52c4a2c79f72bafd8ff986e87e6dd3fd0f8ae37ecb7c744a6952c78107e7f6d9c

Download Submit
C:\Windows\{EC004721-7537-47df-BB0F-B59257E49C53}.exe

Filesize
408KB

MD5
a452d9eb0d0c21d719497be31ebaf949

SHA1
433662708bbca73d5665337984c37ae4123c80de

SHA256
e4bde61b5ccf4573abc1d3cad984a36ef60e2d92e3cfb5c878de91fbf5392f50

SHA512
e7bc4b394e29054956764067c05ec77a50ef87e9ec84676043e5f78eef0ae0d52c4a2c79f72bafd8ff986e87e6dd3fd0f8ae37ecb7c744a6952c78107e7f6d9c

Download Submit
C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe

Filesize
408KB

MD5
3b99771321a2cf19b8ee7b0d86e09232

SHA1
bb2a76c433d0cf6332d5f2d36f70368a3610c704

SHA256
2d25dd118d6c26444ba610ba6f3651c9fcb0f97abbcef42868c63af27a8cbbed

SHA512
b9bb23048f486f1e5001dad16fd3f36f2b8c4662703ffeb1a001176b642812199f7e610eafe3c6011786153f0cd157cbaa69b7e4404a30fa0b722e5c97d31a6f

Download Submit
C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe

Filesize
408KB

MD5
3b99771321a2cf19b8ee7b0d86e09232

SHA1
bb2a76c433d0cf6332d5f2d36f70368a3610c704

SHA256
2d25dd118d6c26444ba610ba6f3651c9fcb0f97abbcef42868c63af27a8cbbed

SHA512
b9bb23048f486f1e5001dad16fd3f36f2b8c4662703ffeb1a001176b642812199f7e610eafe3c6011786153f0cd157cbaa69b7e4404a30fa0b722e5c97d31a6f

Download Submit
C:\Windows\{EC51F452-4B14-4e72-BBF1-9BA9B5B3D4C4}.exe

Filesize
408KB

MD5
3b99771321a2cf19b8ee7b0d86e09232

SHA1
bb2a76c433d0cf6332d5f2d36f70368a3610c704

SHA256
2d25dd118d6c26444ba610ba6f3651c9fcb0f97abbcef42868c63af27a8cbbed

SHA512
b9bb23048f486f1e5001dad16fd3f36f2b8c4662703ffeb1a001176b642812199f7e610eafe3c6011786153f0cd157cbaa69b7e4404a30fa0b722e5c97d31a6f

Download Submit
C:\Windows\{FB35B9EC-5EB0-44c7-81F5-F2AF95E2C000}.exe

Filesize
408KB

MD5
25f79b195944466370e14060fb8e4462

SHA1
b82185ab88a24093dab8af34e7c8257875a97467

SHA256
ba21d1ecfec1c97b4f053e77ad905f87f8abb05b4a087c24764e2ec98040a50b

SHA512
5206def96f34b564b4b51ffd61f585cbdc25bdf60014cc301c524a25bc3d0ede48eae5252a0dcaa4ec840b7083a4c37dab17adf45add550acbad991f63f4def9

Download Submit