6d8c6d7e20f62b890e54c1c3b41d5faab625784c5f0158f6f2c380d614bb5067

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5350317f4f773exeexeexeex.exe
Size

192KB
MD5

d5350317f4f773b328a918adcc4cfdc5
SHA1

efb5e1a876187cec0a6a86e5bbe0c2246211101d
SHA256

6d8c6d7e20f62b890e54c1c3b41d5faab625784c5f0158f6f2c380d614bb5067
SHA512

44f940d256f5676c32dc2ffed722c59471295957edd7c9c13bb8edaf23684862c705977283fc11498b5d3bfe85b3a54828a6c56a81fa29cbb66a5e8a43089b3b
SSDEEP

1536:1EGh0oRl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oRl1OPOe2MUVg3Ve+rXfMUa

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}\stubpath = "C:\\Windows\\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe"	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{814DEF9E-E78C-459a-B408-2D6E7D96F900}\stubpath = "C:\\Windows\\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe"	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24A90118-9C5D-448d-A29C-E4207A84E270}	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EF7A3BB-737A-4a81-A640-30320205C5E0}\stubpath = "C:\\Windows\\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe"	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}	d5350317f4f773exeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EF7A3BB-737A-4a81-A640-30320205C5E0}	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{357A6DC6-3382-4b25-AECF-415A65A554F4}	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}\stubpath = "C:\\Windows\\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe"	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{357A6DC6-3382-4b25-AECF-415A65A554F4}\stubpath = "C:\\Windows\\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe"	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C63405E-05B5-455d-A60B-94A2C15A4E85}	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}\stubpath = "C:\\Windows\\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe"	{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C63405E-05B5-455d-A60B-94A2C15A4E85}\stubpath = "C:\\Windows\\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe"	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{814DEF9E-E78C-459a-B408-2D6E7D96F900}	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24A90118-9C5D-448d-A29C-E4207A84E270}\stubpath = "C:\\Windows\\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe"	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}	{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}\stubpath = "C:\\Windows\\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe"	d5350317f4f773exeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}\stubpath = "C:\\Windows\\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe"	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}\stubpath = "C:\\Windows\\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe"	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}\stubpath = "C:\\Windows\\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe"	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe

Executes dropped EXE 12 IoCs

pid	Process
4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
560	{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
488	{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
File created	C:\Windows\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe	{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
File created	C:\Windows\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	d5350317f4f773exeexeexeex.exe
File created	C:\Windows\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
File created	C:\Windows\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
File created	C:\Windows\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
File created	C:\Windows\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
File created	C:\Windows\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
File created	C:\Windows\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
File created	C:\Windows\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
File created	C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
File created	C:\Windows\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3364	d5350317f4f773exeexeexeex.exe
Token: SeIncBasePriorityPrivilege	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
Token: SeIncBasePriorityPrivilege	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
Token: SeIncBasePriorityPrivilege	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
Token: SeIncBasePriorityPrivilege	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
Token: SeIncBasePriorityPrivilege	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
Token: SeIncBasePriorityPrivilege	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
Token: SeIncBasePriorityPrivilege	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
Token: SeIncBasePriorityPrivilege	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
Token: SeIncBasePriorityPrivilege	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
Token: SeIncBasePriorityPrivilege	3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
Token: SeIncBasePriorityPrivilege	560	{24A90118-9C5D-448d-A29C-E4207A84E270}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4676	3364	d5350317f4f773exeexeexeex.exe	84
PID 3364 wrote to memory of 4676	3364	d5350317f4f773exeexeexeex.exe	84
PID 3364 wrote to memory of 4676	3364	d5350317f4f773exeexeexeex.exe	84
PID 3364 wrote to memory of 560	3364	d5350317f4f773exeexeexeex.exe	85
PID 3364 wrote to memory of 560	3364	d5350317f4f773exeexeexeex.exe	85
PID 3364 wrote to memory of 560	3364	d5350317f4f773exeexeexeex.exe	85
PID 4676 wrote to memory of 3416	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	86
PID 4676 wrote to memory of 3416	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	86
PID 4676 wrote to memory of 3416	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	86
PID 4676 wrote to memory of 3752	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	87
PID 4676 wrote to memory of 3752	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	87
PID 4676 wrote to memory of 3752	4676	{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe	87
PID 3416 wrote to memory of 3892	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	91
PID 3416 wrote to memory of 3892	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	91
PID 3416 wrote to memory of 3892	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	91
PID 3416 wrote to memory of 1312	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	92
PID 3416 wrote to memory of 1312	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	92
PID 3416 wrote to memory of 1312	3416	{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe	92
PID 3892 wrote to memory of 1928	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	93
PID 3892 wrote to memory of 1928	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	93
PID 3892 wrote to memory of 1928	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	93
PID 3892 wrote to memory of 4400	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	94
PID 3892 wrote to memory of 4400	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	94
PID 3892 wrote to memory of 4400	3892	{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe	94
PID 1928 wrote to memory of 3000	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	95
PID 1928 wrote to memory of 3000	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	95
PID 1928 wrote to memory of 3000	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	95
PID 1928 wrote to memory of 2636	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	96
PID 1928 wrote to memory of 2636	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	96
PID 1928 wrote to memory of 2636	1928	{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe	96
PID 3000 wrote to memory of 3652	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	98
PID 3000 wrote to memory of 3652	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	98
PID 3000 wrote to memory of 3652	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	98
PID 3000 wrote to memory of 3340	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	99
PID 3000 wrote to memory of 3340	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	99
PID 3000 wrote to memory of 3340	3000	{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe	99
PID 3652 wrote to memory of 1232	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	100
PID 3652 wrote to memory of 1232	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	100
PID 3652 wrote to memory of 1232	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	100
PID 3652 wrote to memory of 1516	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	101
PID 3652 wrote to memory of 1516	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	101
PID 3652 wrote to memory of 1516	3652	{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe	101
PID 1232 wrote to memory of 3880	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	103
PID 1232 wrote to memory of 3880	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	103
PID 1232 wrote to memory of 3880	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	103
PID 1232 wrote to memory of 4936	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	104
PID 1232 wrote to memory of 4936	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	104
PID 1232 wrote to memory of 4936	1232	{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe	104
PID 3880 wrote to memory of 4304	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	110
PID 3880 wrote to memory of 4304	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	110
PID 3880 wrote to memory of 4304	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	110
PID 3880 wrote to memory of 4780	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	111
PID 3880 wrote to memory of 4780	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	111
PID 3880 wrote to memory of 4780	3880	{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe	111
PID 4304 wrote to memory of 3272	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	112
PID 4304 wrote to memory of 3272	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	112
PID 4304 wrote to memory of 3272	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	112
PID 4304 wrote to memory of 3332	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	113
PID 4304 wrote to memory of 3332	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	113
PID 4304 wrote to memory of 3332	4304	{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe	113
PID 3272 wrote to memory of 560	3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe	115
PID 3272 wrote to memory of 560	3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe	115
PID 3272 wrote to memory of 560	3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe	115
PID 3272 wrote to memory of 4868	3272	{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe	114

C:\Users\Admin\AppData\Local\Temp\d5350317f4f773exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\d5350317f4f773exeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
  C:\Windows\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
    C:\Windows\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
      C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
        
        C:\Windows\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\Windows\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
        
        C:\Windows\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
        
        C:\Windows\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
        
        C:\Windows\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
        
        C:\Windows\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
        
        C:\Windows\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
        
        C:\Windows\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{814DE~1.EXE > nul
        12⤵
        
        PID:4868
        
        C:\Windows\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
        
        C:\Windows\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
        
        C:\Windows\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe
        
        C:\Windows\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe
        13⤵
        Executes dropped EXE
        
        PID:488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{24A90~1.EXE > nul
        13⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5C634~1.EXE > nul
        11⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5D10F~1.EXE > nul
        10⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDFB5~1.EXE > nul
        9⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F2EC~1.EXE > nul
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{357A6~1.EXE > nul
        7⤵
        
        PID:3340
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7EEAC~1.EXE > nul
        6⤵
        
        PID:2636
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5EF7A~1.EXE > nul
        5⤵
        
        PID:4400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A1F20~1.EXE > nul
      4⤵
      PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CACD8~1.EXE > nul
    3⤵
    PID:3752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D53503~1.EXE > nul
  2⤵
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe

Filesize
192KB

MD5
4d8856422ee590665e31309b839f86af

SHA1
5fe16d256909dd7497337479865b5a0739b87592

SHA256
a50ad417735f4751b5c39332ae7238a6bb1f1832f8734d7601f1ea2e9023e01a

SHA512
13aa82d77b5cd7b1daf53d8c4b82caea084cf26ed9f3bac873c55687b2dc074da8a509139c5d007bdee38f09227592e39c40fb4afd3aa00d7b780463c2fac484

Download Submit
C:\Windows\{24A90118-9C5D-448d-A29C-E4207A84E270}.exe

Filesize
192KB

MD5
4d8856422ee590665e31309b839f86af

SHA1
5fe16d256909dd7497337479865b5a0739b87592

SHA256
a50ad417735f4751b5c39332ae7238a6bb1f1832f8734d7601f1ea2e9023e01a

SHA512
13aa82d77b5cd7b1daf53d8c4b82caea084cf26ed9f3bac873c55687b2dc074da8a509139c5d007bdee38f09227592e39c40fb4afd3aa00d7b780463c2fac484

Download Submit
C:\Windows\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe

Filesize
192KB

MD5
e1abc93b9e92c0be5f2e75edbd9281e8

SHA1
448ef577175015ec46e48ca42a8d367a1187c175

SHA256
04432e1550deb7bb537192c566ca97597894a26805081da1e4c250ae17a8e36a

SHA512
b2154f14f9419c05e483c58ba8da5acf2a55021e1e2c784569dd74dedb515f0186bdfc6b27cb5c9b9aba8001c8d4a54339c93db7d6ecb0760493eeb7a28ddb3a

Download Submit
C:\Windows\{357A6DC6-3382-4b25-AECF-415A65A554F4}.exe

Filesize
192KB

MD5
e1abc93b9e92c0be5f2e75edbd9281e8

SHA1
448ef577175015ec46e48ca42a8d367a1187c175

SHA256
04432e1550deb7bb537192c566ca97597894a26805081da1e4c250ae17a8e36a

SHA512
b2154f14f9419c05e483c58ba8da5acf2a55021e1e2c784569dd74dedb515f0186bdfc6b27cb5c9b9aba8001c8d4a54339c93db7d6ecb0760493eeb7a28ddb3a

Download Submit
C:\Windows\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe

Filesize
192KB

MD5
ef23c6494861c59b5ba06366c96f5ab4

SHA1
376c07f618d5fa3aef82063a3f5a777aa64a483c

SHA256
4f3b782e88c0154eb038dc6bddf95a1ae17ab8e6a46e740f26458719ed6e7213

SHA512
07bf76d69f940a7a2ff92e6c49d6d1ffedebf9329c00ebe26ac88a85e30dee36e2ea68b78dccfece9bf8c4511c82fbc72a25ffde7094a046fabaa228a61a5829

Download Submit
C:\Windows\{5C63405E-05B5-455d-A60B-94A2C15A4E85}.exe

Filesize
192KB

MD5
ef23c6494861c59b5ba06366c96f5ab4

SHA1
376c07f618d5fa3aef82063a3f5a777aa64a483c

SHA256
4f3b782e88c0154eb038dc6bddf95a1ae17ab8e6a46e740f26458719ed6e7213

SHA512
07bf76d69f940a7a2ff92e6c49d6d1ffedebf9329c00ebe26ac88a85e30dee36e2ea68b78dccfece9bf8c4511c82fbc72a25ffde7094a046fabaa228a61a5829

Download Submit
C:\Windows\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe

Filesize
192KB

MD5
e7eba1944f318b91e75536cf7148eb0f

SHA1
38a800314c21ceed41c66dcc2c552ab30b3d16ce

SHA256
86d680ab4314f747870c4e888b67b61bbfdc6f7de993539fb0bfcf0a4f4de4d5

SHA512
b67b7237bf02e0578433a78075701735f56c6246b687561a4c50d7d19e21d261b7fd0d7b8b79f677d0a54fd03e295efbdca9ded3944568f300a26d14b7b88d80

Download Submit
C:\Windows\{5D10F0B9-5D61-4fa7-97D6-A6FD09A214BE}.exe

Filesize
192KB

MD5
e7eba1944f318b91e75536cf7148eb0f

SHA1
38a800314c21ceed41c66dcc2c552ab30b3d16ce

SHA256
86d680ab4314f747870c4e888b67b61bbfdc6f7de993539fb0bfcf0a4f4de4d5

SHA512
b67b7237bf02e0578433a78075701735f56c6246b687561a4c50d7d19e21d261b7fd0d7b8b79f677d0a54fd03e295efbdca9ded3944568f300a26d14b7b88d80

Download Submit
C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe

Filesize
192KB

MD5
232ee7d015d4c47eec84057be52c4a4b

SHA1
5d03ec4679a19bd70033ba0847a11176ad97a01a

SHA256
84f358fdd18edb13624df73c62d4a063f548144e1db8e463fe637a9432e8e2a8

SHA512
d095677285b92e151536a39d5480335920bdfe7d4feaaf73c91ceaf0b9503ceca5dc4403c0cd469884a1f56fe421101ffbdf81a4a7cdc0ea634934a7ffc4c560

Download Submit
C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe

Filesize
192KB

MD5
232ee7d015d4c47eec84057be52c4a4b

SHA1
5d03ec4679a19bd70033ba0847a11176ad97a01a

SHA256
84f358fdd18edb13624df73c62d4a063f548144e1db8e463fe637a9432e8e2a8

SHA512
d095677285b92e151536a39d5480335920bdfe7d4feaaf73c91ceaf0b9503ceca5dc4403c0cd469884a1f56fe421101ffbdf81a4a7cdc0ea634934a7ffc4c560

Download Submit
C:\Windows\{5EF7A3BB-737A-4a81-A640-30320205C5E0}.exe

Filesize
192KB

MD5
232ee7d015d4c47eec84057be52c4a4b

SHA1
5d03ec4679a19bd70033ba0847a11176ad97a01a

SHA256
84f358fdd18edb13624df73c62d4a063f548144e1db8e463fe637a9432e8e2a8

SHA512
d095677285b92e151536a39d5480335920bdfe7d4feaaf73c91ceaf0b9503ceca5dc4403c0cd469884a1f56fe421101ffbdf81a4a7cdc0ea634934a7ffc4c560

Download Submit
C:\Windows\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe

Filesize
192KB

MD5
633015ac2ae06ba044c39e8449c848be

SHA1
fdc1d2b727aa355bb3437451e4ab2696bbbb6c52

SHA256
93da838262bb88889b6e75db0e92dc580ce27c6f83923b31dec9d8d2f44a40f8

SHA512
a64a8930eacfb7daf93916a8dbdf7ae58ead4fa2e8e5dd9c51f72cf55321a1cd84fb0f1dca2c5910c555e210f029de8103fd1f03d4dd5d88dbd5c4d324f1811b

Download Submit
C:\Windows\{7EEACE74-8214-45c7-87B4-28D6AC0EDA5B}.exe

Filesize
192KB

MD5
633015ac2ae06ba044c39e8449c848be

SHA1
fdc1d2b727aa355bb3437451e4ab2696bbbb6c52

SHA256
93da838262bb88889b6e75db0e92dc580ce27c6f83923b31dec9d8d2f44a40f8

SHA512
a64a8930eacfb7daf93916a8dbdf7ae58ead4fa2e8e5dd9c51f72cf55321a1cd84fb0f1dca2c5910c555e210f029de8103fd1f03d4dd5d88dbd5c4d324f1811b

Download Submit
C:\Windows\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe

Filesize
192KB

MD5
d3273d0107b8c082f382c69ee62850f8

SHA1
67a00ee2a808ff54427d44835d62f6dfea35bdac

SHA256
bf9e7b85e000b6e84c9bc85c38cab9ab5e719d38644f6ff4c0b7f6c1992793d2

SHA512
10ab46af780450de883e4d0926969e2124d4b7e5bee7a0760256dd778ee0647e286e47c57fb6b54d1168d6936662935c3d9b0207113052c3c67739f7280d90e1

Download Submit
C:\Windows\{814DEF9E-E78C-459a-B408-2D6E7D96F900}.exe

Filesize
192KB

MD5
d3273d0107b8c082f382c69ee62850f8

SHA1
67a00ee2a808ff54427d44835d62f6dfea35bdac

SHA256
bf9e7b85e000b6e84c9bc85c38cab9ab5e719d38644f6ff4c0b7f6c1992793d2

SHA512
10ab46af780450de883e4d0926969e2124d4b7e5bee7a0760256dd778ee0647e286e47c57fb6b54d1168d6936662935c3d9b0207113052c3c67739f7280d90e1

Download Submit
C:\Windows\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe

Filesize
192KB

MD5
816166d7575226f2d230ddc67b8450ca

SHA1
de5f8a536ed2693fc5a4209ecdd455d510bccd1c

SHA256
e9d2fbd72e5e8b11421ca32e53ad6015f53df4948b96f190ca3bf7775df0f767

SHA512
d8131eb23b3b06046b48223b1eea556b5c29590fb033de5a15de6dba2e5229314abc800de30be2c2555864bf52ed9f623af204600327f6ad6cd6dec3f6db5308

Download Submit
C:\Windows\{9F2ECDD1-7A8D-4121-A163-E5C1767B9536}.exe

Filesize
192KB

MD5
816166d7575226f2d230ddc67b8450ca

SHA1
de5f8a536ed2693fc5a4209ecdd455d510bccd1c

SHA256
e9d2fbd72e5e8b11421ca32e53ad6015f53df4948b96f190ca3bf7775df0f767

SHA512
d8131eb23b3b06046b48223b1eea556b5c29590fb033de5a15de6dba2e5229314abc800de30be2c2555864bf52ed9f623af204600327f6ad6cd6dec3f6db5308

Download Submit
C:\Windows\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe

Filesize
192KB

MD5
4717ab85216e94c89c2cb2291005d054

SHA1
a757ab891a6f5add666b7016eb5a55629ed48aa6

SHA256
82ac8e16576143049d9343347b4d9da356257a6990de5bebfdae874291b59e67

SHA512
5d6763c5eb401ac961726a39f3c8844296ae1669023e5ac040c8f132c24344ec6274c5ee442ae285ea4101414cd7afc69d6561e2cb7c30a2f1235311380a7dea

Download Submit
C:\Windows\{A1F20E26-AEA2-4b65-A1E4-A22A7D0BBDD2}.exe

Filesize
192KB

MD5
4717ab85216e94c89c2cb2291005d054

SHA1
a757ab891a6f5add666b7016eb5a55629ed48aa6

SHA256
82ac8e16576143049d9343347b4d9da356257a6990de5bebfdae874291b59e67

SHA512
5d6763c5eb401ac961726a39f3c8844296ae1669023e5ac040c8f132c24344ec6274c5ee442ae285ea4101414cd7afc69d6561e2cb7c30a2f1235311380a7dea

Download Submit
C:\Windows\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe

Filesize
192KB

MD5
2e1f34956bf203425e9e77d9136b0aa9

SHA1
e9c649dfb65cd22c920834869b36f71102cdd7ee

SHA256
984dde3028425e129013c22e7eb216cacac4618c66a7970ad22e8b597ec2a335

SHA512
3b6c7e2d554fd2c17f4a2b39ce626feb2c18fe2543da23edb76dab91c6629ba823f24031cdf9a7fdc61bee6d7513e2773adf4e1311473a8c7331a6d273838bb1

Download Submit
C:\Windows\{BDFB5E09-41EE-40f3-BBCB-F48F4B8DAB0B}.exe

Filesize
192KB

MD5
2e1f34956bf203425e9e77d9136b0aa9

SHA1
e9c649dfb65cd22c920834869b36f71102cdd7ee

SHA256
984dde3028425e129013c22e7eb216cacac4618c66a7970ad22e8b597ec2a335

SHA512
3b6c7e2d554fd2c17f4a2b39ce626feb2c18fe2543da23edb76dab91c6629ba823f24031cdf9a7fdc61bee6d7513e2773adf4e1311473a8c7331a6d273838bb1

Download Submit
C:\Windows\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe

Filesize
192KB

MD5
a43f7a08eb5455d420d0814bd47c7d2d

SHA1
95f3e5a5b1086b428ecfebc86bd09205144d82aa

SHA256
f928aa96f43e137a6b6666cb630cbb05c333787343c03d7a9fceb861aa44984b

SHA512
5fe2f9c12e7380021d6dc14f635f4cd62be650c65e6880a6e04c41f7eff905638e9adf4d3c8dcc07f51ed4b8f703ed44b43de4710edc980c1ee9cac66a2e2687

Download Submit
C:\Windows\{CACD81EF-73AE-421e-8CBF-7E031BC4966A}.exe

Filesize
192KB

MD5
a43f7a08eb5455d420d0814bd47c7d2d

SHA1
95f3e5a5b1086b428ecfebc86bd09205144d82aa

SHA256
f928aa96f43e137a6b6666cb630cbb05c333787343c03d7a9fceb861aa44984b

SHA512
5fe2f9c12e7380021d6dc14f635f4cd62be650c65e6880a6e04c41f7eff905638e9adf4d3c8dcc07f51ed4b8f703ed44b43de4710edc980c1ee9cac66a2e2687

Download Submit
C:\Windows\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe

Filesize
192KB

MD5
b8ee51bdea7df96c61ec6b4126d284a8

SHA1
6a09ccb9d496129a4f66c4a5f376e995f9d9ce3c

SHA256
5f6c55b8ca2140c47d35e7225bf6a2352f63db7558dd27c06881f6df4e2c47d5

SHA512
385e4c8fbe4660118fbe250039aea469136be2272d95cadded1924d8ecba8b6ec023f2dc07b2751582ad3b353fd6ea7a62aac07987db5cda4907f55616f14bf0

Download Submit
C:\Windows\{F37CC7A4-ABEC-47c2-A916-3294A6890EC0}.exe

Filesize
192KB

MD5
b8ee51bdea7df96c61ec6b4126d284a8

SHA1
6a09ccb9d496129a4f66c4a5f376e995f9d9ce3c

SHA256
5f6c55b8ca2140c47d35e7225bf6a2352f63db7558dd27c06881f6df4e2c47d5

SHA512
385e4c8fbe4660118fbe250039aea469136be2272d95cadded1924d8ecba8b6ec023f2dc07b2751582ad3b353fd6ea7a62aac07987db5cda4907f55616f14bf0

Download Submit