8e04bd87b221465b61edaae3b033d1530aa3c9778372c8ceb547dc85a8a616ef

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2023, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca3f2cf5d8cabexeexeexeex.exe
Size

168KB
MD5

dca3f2cf5d8cab8c969caf2504437152
SHA1

9c053d62aa9956d4bc31b50d90d7ac00d182f999
SHA256

8e04bd87b221465b61edaae3b033d1530aa3c9778372c8ceb547dc85a8a616ef
SHA512

a7a85406d6505db880a28386fa3737dd192e64d204bc077c31d8e222bb59d2c3badf128bfe3e49ae98594505ff063c536429699f8cd885d7783d172102cd39d7
SSDEEP

1536:1EGh0oRlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oRlqOPOe2MUVg3Ve+rX

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{085727D5-9768-4f39-A93D-732A48939EA8}\stubpath = "C:\\Windows\\{085727D5-9768-4f39-A93D-732A48939EA8}.exe"	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}\stubpath = "C:\\Windows\\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe"	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72559213-FADD-4779-B6A8-A6D5528C27CB}	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}\stubpath = "C:\\Windows\\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe"	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA8A3301-8C84-49db-A843-8E66BB935F07}\stubpath = "C:\\Windows\\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe"	{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{085727D5-9768-4f39-A93D-732A48939EA8}	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}\stubpath = "C:\\Windows\\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe"	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DD7396E-9401-4d53-A174-7213A03F94F3}	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}\stubpath = "C:\\Windows\\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe"	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}	dca3f2cf5d8cabexeexeexeex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}\stubpath = "C:\\Windows\\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe"	dca3f2cf5d8cabexeexeexeex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA8A3301-8C84-49db-A843-8E66BB935F07}	{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA9A63F9-06A7-49ae-8089-3D37D2247314}	{085727D5-9768-4f39-A93D-732A48939EA8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA9A63F9-06A7-49ae-8089-3D37D2247314}\stubpath = "C:\\Windows\\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe"	{085727D5-9768-4f39-A93D-732A48939EA8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DD7396E-9401-4d53-A174-7213A03F94F3}\stubpath = "C:\\Windows\\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe"	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72559213-FADD-4779-B6A8-A6D5528C27CB}\stubpath = "C:\\Windows\\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe"	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}\stubpath = "C:\\Windows\\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe"	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}\stubpath = "C:\\Windows\\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe"	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe

Executes dropped EXE 12 IoCs

pid	Process
1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe
2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
3992	{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe
644	{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
File created	C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
File created	C:\Windows\{085727D5-9768-4f39-A93D-732A48939EA8}.exe	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
File created	C:\Windows\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	{085727D5-9768-4f39-A93D-732A48939EA8}.exe
File created	C:\Windows\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
File created	C:\Windows\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	dca3f2cf5d8cabexeexeexeex.exe
File created	C:\Windows\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
File created	C:\Windows\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
File created	C:\Windows\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
File created	C:\Windows\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
File created	C:\Windows\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
File created	C:\Windows\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe	{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4128	dca3f2cf5d8cabexeexeexeex.exe
Token: SeIncBasePriorityPrivilege	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
Token: SeIncBasePriorityPrivilege	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
Token: SeIncBasePriorityPrivilege	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
Token: SeIncBasePriorityPrivilege	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe
Token: SeIncBasePriorityPrivilege	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
Token: SeIncBasePriorityPrivilege	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
Token: SeIncBasePriorityPrivilege	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
Token: SeIncBasePriorityPrivilege	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
Token: SeIncBasePriorityPrivilege	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
Token: SeIncBasePriorityPrivilege	3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
Token: SeIncBasePriorityPrivilege	3992	{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 1728	4128	dca3f2cf5d8cabexeexeexeex.exe	88
PID 4128 wrote to memory of 1728	4128	dca3f2cf5d8cabexeexeexeex.exe	88
PID 4128 wrote to memory of 1728	4128	dca3f2cf5d8cabexeexeexeex.exe	88
PID 4128 wrote to memory of 4372	4128	dca3f2cf5d8cabexeexeexeex.exe	89
PID 4128 wrote to memory of 4372	4128	dca3f2cf5d8cabexeexeexeex.exe	89
PID 4128 wrote to memory of 4372	4128	dca3f2cf5d8cabexeexeexeex.exe	89
PID 1728 wrote to memory of 644	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	90
PID 1728 wrote to memory of 644	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	90
PID 1728 wrote to memory of 644	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	90
PID 1728 wrote to memory of 2592	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	91
PID 1728 wrote to memory of 2592	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	91
PID 1728 wrote to memory of 2592	1728	{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe	91
PID 644 wrote to memory of 1276	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	95
PID 644 wrote to memory of 1276	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	95
PID 644 wrote to memory of 1276	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	95
PID 644 wrote to memory of 2636	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	96
PID 644 wrote to memory of 2636	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	96
PID 644 wrote to memory of 2636	644	{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe	96
PID 1276 wrote to memory of 4088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	97
PID 1276 wrote to memory of 4088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	97
PID 1276 wrote to memory of 4088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	97
PID 1276 wrote to memory of 1088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	98
PID 1276 wrote to memory of 1088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	98
PID 1276 wrote to memory of 1088	1276	{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe	98
PID 4088 wrote to memory of 2336	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	99
PID 4088 wrote to memory of 2336	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	99
PID 4088 wrote to memory of 2336	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	99
PID 4088 wrote to memory of 3300	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	100
PID 4088 wrote to memory of 3300	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	100
PID 4088 wrote to memory of 3300	4088	{085727D5-9768-4f39-A93D-732A48939EA8}.exe	100
PID 2336 wrote to memory of 4152	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	102
PID 2336 wrote to memory of 4152	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	102
PID 2336 wrote to memory of 4152	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	102
PID 2336 wrote to memory of 4900	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	103
PID 2336 wrote to memory of 4900	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	103
PID 2336 wrote to memory of 4900	2336	{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe	103
PID 4152 wrote to memory of 3356	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	104
PID 4152 wrote to memory of 3356	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	104
PID 4152 wrote to memory of 3356	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	104
PID 4152 wrote to memory of 1076	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	105
PID 4152 wrote to memory of 1076	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	105
PID 4152 wrote to memory of 1076	4152	{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe	105
PID 3356 wrote to memory of 1468	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	108
PID 3356 wrote to memory of 1468	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	108
PID 3356 wrote to memory of 1468	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	108
PID 3356 wrote to memory of 3976	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	109
PID 3356 wrote to memory of 3976	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	109
PID 3356 wrote to memory of 3976	3356	{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe	109
PID 1468 wrote to memory of 2700	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	114
PID 1468 wrote to memory of 2700	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	114
PID 1468 wrote to memory of 2700	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	114
PID 1468 wrote to memory of 216	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	115
PID 1468 wrote to memory of 216	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	115
PID 1468 wrote to memory of 216	1468	{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe	115
PID 2700 wrote to memory of 3872	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	116
PID 2700 wrote to memory of 3872	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	116
PID 2700 wrote to memory of 3872	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	116
PID 2700 wrote to memory of 1132	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	117
PID 2700 wrote to memory of 1132	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	117
PID 2700 wrote to memory of 1132	2700	{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe	117
PID 3872 wrote to memory of 3992	3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe	118
PID 3872 wrote to memory of 3992	3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe	118
PID 3872 wrote to memory of 3992	3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe	118
PID 3872 wrote to memory of 4824	3872	{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe	119

C:\Users\Admin\AppData\Local\Temp\dca3f2cf5d8cabexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\dca3f2cf5d8cabexeexeexeex.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
  C:\Windows\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
    C:\Windows\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
      C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Windows\{085727D5-9768-4f39-A93D-732A48939EA8}.exe
        
        C:\Windows\{085727D5-9768-4f39-A93D-732A48939EA8}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4088
      - C:\Windows\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
        
        C:\Windows\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
        
        C:\Windows\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
        
        C:\Windows\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
        
        C:\Windows\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
        
        C:\Windows\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
        
        C:\Windows\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe
        
        C:\Windows\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3992
        
        C:\Windows\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe
        
        C:\Windows\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe
        13⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4A344~1.EXE > nul
        13⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E4FC~1.EXE > nul
        12⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{72559~1.EXE > nul
        11⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E9AB3~1.EXE > nul
        10⤵
        
        PID:216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1DD73~1.EXE > nul
        9⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3BEF5~1.EXE > nul
        8⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CA9A6~1.EXE > nul
        7⤵
        
        PID:4900
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{08572~1.EXE > nul
        6⤵
        
        PID:3300
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D6B17~1.EXE > nul
        5⤵
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F1E62~1.EXE > nul
      4⤵
      PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A89D6~1.EXE > nul
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\DCA3F2~1.EXE > nul
  2⤵
  PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{085727D5-9768-4f39-A93D-732A48939EA8}.exe

Filesize
168KB

MD5
7310a4d98ed9ca92ad657ca3951f708f

SHA1
4bdfe106b1745e701e0d47c1fa462d9138956fcd

SHA256
63be921e5bf28698fbc70e50db7bfda0d20b597ac79c5ff50f721ca41cb450a6

SHA512
97219b2a32937315d07c183f6093ad1ce0cf25df5639dc2b3298386ac43f061f2483a15da608410f51113d5e237e462f00d8bf086cc1aeea56ad4f56e8be6410

Download Submit
C:\Windows\{085727D5-9768-4f39-A93D-732A48939EA8}.exe

Filesize
168KB

MD5
7310a4d98ed9ca92ad657ca3951f708f

SHA1
4bdfe106b1745e701e0d47c1fa462d9138956fcd

SHA256
63be921e5bf28698fbc70e50db7bfda0d20b597ac79c5ff50f721ca41cb450a6

SHA512
97219b2a32937315d07c183f6093ad1ce0cf25df5639dc2b3298386ac43f061f2483a15da608410f51113d5e237e462f00d8bf086cc1aeea56ad4f56e8be6410

Download Submit
C:\Windows\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe

Filesize
168KB

MD5
fb2c6ef6347f6d8279686cfde35bc6d5

SHA1
f443584a1cc34389ad1965e953d2b806d4946abf

SHA256
f7b995a9d31c6c50be71d9395f21cf2c81d434d686fde7f649b22b19cc56ae8e

SHA512
a48a12fa391fdccfe48733c9c890293c111c779df55d7abf090b96523e83bb17eb4ec8822843eb25f83c47f394cad5e2abe6620aee2c3d7ac4afa7bce8670cbc

Download Submit
C:\Windows\{1DD7396E-9401-4d53-A174-7213A03F94F3}.exe

Filesize
168KB

MD5
fb2c6ef6347f6d8279686cfde35bc6d5

SHA1
f443584a1cc34389ad1965e953d2b806d4946abf

SHA256
f7b995a9d31c6c50be71d9395f21cf2c81d434d686fde7f649b22b19cc56ae8e

SHA512
a48a12fa391fdccfe48733c9c890293c111c779df55d7abf090b96523e83bb17eb4ec8822843eb25f83c47f394cad5e2abe6620aee2c3d7ac4afa7bce8670cbc

Download Submit
C:\Windows\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe

Filesize
168KB

MD5
36b85f8e087cc274a2a3da22d2e2b616

SHA1
ea14d53ef9e47cfe5a460db0e6262565f1885d30

SHA256
e578c04b7a8b9f68943b865e527fa089933bb2fd70d5c2dcea7d7d3af2b0d380

SHA512
8e7eb49a9be068d4ae9310b7ac3ebb65e6d39ca244708bfeced352ce79a75d0c47b292ce68713b582342cc41cdb449b07ce0bca416650ebe98a0106bb6e29b10

Download Submit
C:\Windows\{3BEF55B2-4723-4883-B0B1-53F6DD90E635}.exe

Filesize
168KB

MD5
36b85f8e087cc274a2a3da22d2e2b616

SHA1
ea14d53ef9e47cfe5a460db0e6262565f1885d30

SHA256
e578c04b7a8b9f68943b865e527fa089933bb2fd70d5c2dcea7d7d3af2b0d380

SHA512
8e7eb49a9be068d4ae9310b7ac3ebb65e6d39ca244708bfeced352ce79a75d0c47b292ce68713b582342cc41cdb449b07ce0bca416650ebe98a0106bb6e29b10

Download Submit
C:\Windows\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe

Filesize
168KB

MD5
eb73118bd0811cb6e7a2ba6bc0a39b0c

SHA1
7e1585d061f0885448b08abd054a1843ef84a7e8

SHA256
ca174ee7c2289e2bb5cf6dab483b5da0760bc20643e919f2aa28472f4dd7276b

SHA512
df90ea924196f48c695b074be25281d81b23b257b05857600624c072962050b7861e4761cce72ebe22b15b78f10a0dc1a22ab0f5008de7503aef9b67ef70bcde

Download Submit
C:\Windows\{4A3443E1-9A03-4b38-B9F2-FD2485615E97}.exe

Filesize
168KB

MD5
eb73118bd0811cb6e7a2ba6bc0a39b0c

SHA1
7e1585d061f0885448b08abd054a1843ef84a7e8

SHA256
ca174ee7c2289e2bb5cf6dab483b5da0760bc20643e919f2aa28472f4dd7276b

SHA512
df90ea924196f48c695b074be25281d81b23b257b05857600624c072962050b7861e4761cce72ebe22b15b78f10a0dc1a22ab0f5008de7503aef9b67ef70bcde

Download Submit
C:\Windows\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe

Filesize
168KB

MD5
ca8c1e2c19ce75d3dac3d13042a53b09

SHA1
0381b22718eece085345083254aa1c9c69e77a96

SHA256
15fc46330015fe92ac8f8747e6fa9679e27f6fe27f0d78140b745ed31e7d0797

SHA512
9de6ca840aaaeefc47f00b2afd34208d14a61f4fc92e4c2a0b49ce47fd380168d3c346520bca0a0627ce73833fc7730c6db4bd2374e55bf12c631ca79b335114

Download Submit
C:\Windows\{72559213-FADD-4779-B6A8-A6D5528C27CB}.exe

Filesize
168KB

MD5
ca8c1e2c19ce75d3dac3d13042a53b09

SHA1
0381b22718eece085345083254aa1c9c69e77a96

SHA256
15fc46330015fe92ac8f8747e6fa9679e27f6fe27f0d78140b745ed31e7d0797

SHA512
9de6ca840aaaeefc47f00b2afd34208d14a61f4fc92e4c2a0b49ce47fd380168d3c346520bca0a0627ce73833fc7730c6db4bd2374e55bf12c631ca79b335114

Download Submit
C:\Windows\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe

Filesize
168KB

MD5
a5367b353815bc67089dfb120d60570a

SHA1
26f6bbec4a26491fade418066b0814fc4f4e892e

SHA256
214ee21f7b418fcae9f44377ab003efa14e5ff26570d50697ad58feaea4dbb97

SHA512
e7777da09208b74b67fd9878ff8b1ccc1c75f584966e189bf6c2faed2f0ac9ce372c745d5aa8e59bca84e986f166249a199469ef9c484bba2c717c0ef95a01bb

Download Submit
C:\Windows\{9E4FCA4E-9EC9-452e-AA2C-74556952190A}.exe

Filesize
168KB

MD5
a5367b353815bc67089dfb120d60570a

SHA1
26f6bbec4a26491fade418066b0814fc4f4e892e

SHA256
214ee21f7b418fcae9f44377ab003efa14e5ff26570d50697ad58feaea4dbb97

SHA512
e7777da09208b74b67fd9878ff8b1ccc1c75f584966e189bf6c2faed2f0ac9ce372c745d5aa8e59bca84e986f166249a199469ef9c484bba2c717c0ef95a01bb

Download Submit
C:\Windows\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe

Filesize
168KB

MD5
e6f85566a42848561455682e750b07b9

SHA1
0766e583f6bbca6ba2d9a783148bcfb45363c765

SHA256
44dc4530a971f5febde02a5aff4abf6abbf8e9a86e6e872d9cd2a521e75c4353

SHA512
e1993c53418843bbe2043577574edb296097611a9034ecd34b2f847d1a8b16181bb030f50f7904c42959868f560ce32e77393cdd4a7865a2defd230d537f3630

Download Submit
C:\Windows\{A89D6EC0-71E6-4f36-8D07-5E687A976C2C}.exe

Filesize
168KB

MD5
e6f85566a42848561455682e750b07b9

SHA1
0766e583f6bbca6ba2d9a783148bcfb45363c765

SHA256
44dc4530a971f5febde02a5aff4abf6abbf8e9a86e6e872d9cd2a521e75c4353

SHA512
e1993c53418843bbe2043577574edb296097611a9034ecd34b2f847d1a8b16181bb030f50f7904c42959868f560ce32e77393cdd4a7865a2defd230d537f3630

Download Submit
C:\Windows\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe

Filesize
168KB

MD5
cb9720acd04fc3dfed3c31ec4c3d8dbf

SHA1
936a3e14ad081211e15621300ef7ae7e290a9f1b

SHA256
7018d851b30e13c91c620c36ae220e6a112cfb97500628084824d162f675439f

SHA512
bacfae72e12f999a011ec629a88833c1b62bde33679ab24a725326d1f29f5150800dd4cbd357258095cb71998807cce8c341931c68ee42e588a872f2f3e41a4f

Download Submit
C:\Windows\{CA9A63F9-06A7-49ae-8089-3D37D2247314}.exe

Filesize
168KB

MD5
cb9720acd04fc3dfed3c31ec4c3d8dbf

SHA1
936a3e14ad081211e15621300ef7ae7e290a9f1b

SHA256
7018d851b30e13c91c620c36ae220e6a112cfb97500628084824d162f675439f

SHA512
bacfae72e12f999a011ec629a88833c1b62bde33679ab24a725326d1f29f5150800dd4cbd357258095cb71998807cce8c341931c68ee42e588a872f2f3e41a4f

Download Submit
C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe

Filesize
168KB

MD5
9adb67dc39edd4deac963477d43fc390

SHA1
4f267b6fc98b22db86818d3b1ffc7ec3671d7b49

SHA256
a363f8b751a663dc45c87a2ee24357438fd677a4b95dbd1d3b7a5c87dc39585d

SHA512
256bd533e95dbc9a6c561fbd5f17301f57a4f9b00fa76659e832425f9e77e167776e0bcc153fab9833b13bc1461d6bcfbd7695e5d542994402859c2877ba6868

Download Submit
C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe

Filesize
168KB

MD5
9adb67dc39edd4deac963477d43fc390

SHA1
4f267b6fc98b22db86818d3b1ffc7ec3671d7b49

SHA256
a363f8b751a663dc45c87a2ee24357438fd677a4b95dbd1d3b7a5c87dc39585d

SHA512
256bd533e95dbc9a6c561fbd5f17301f57a4f9b00fa76659e832425f9e77e167776e0bcc153fab9833b13bc1461d6bcfbd7695e5d542994402859c2877ba6868

Download Submit
C:\Windows\{D6B17AD8-132A-4ff5-962B-7C2C12CD36A0}.exe

Filesize
168KB

MD5
9adb67dc39edd4deac963477d43fc390

SHA1
4f267b6fc98b22db86818d3b1ffc7ec3671d7b49

SHA256
a363f8b751a663dc45c87a2ee24357438fd677a4b95dbd1d3b7a5c87dc39585d

SHA512
256bd533e95dbc9a6c561fbd5f17301f57a4f9b00fa76659e832425f9e77e167776e0bcc153fab9833b13bc1461d6bcfbd7695e5d542994402859c2877ba6868

Download Submit
C:\Windows\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe

Filesize
168KB

MD5
6bfc126c1cb47c329613b0fb3378961e

SHA1
4988b45503a1982b993315c89bdacd565b9e5633

SHA256
cee47fb4ee976bf9599854a4895673b06a27763d8a17b99ca8d253265030f841

SHA512
d498b2baad1a7c747e2044528e17a390813ab7869d03c61a3f1817cadddbfb93cc90a436861e3563bd290055fbb7f4d1ae1787fc01eba890481ccfab7790b22e

Download Submit
C:\Windows\{E9AB35A2-1B44-4da1-BEC6-ADC60F4ACD2D}.exe

Filesize
168KB

MD5
6bfc126c1cb47c329613b0fb3378961e

SHA1
4988b45503a1982b993315c89bdacd565b9e5633

SHA256
cee47fb4ee976bf9599854a4895673b06a27763d8a17b99ca8d253265030f841

SHA512
d498b2baad1a7c747e2044528e17a390813ab7869d03c61a3f1817cadddbfb93cc90a436861e3563bd290055fbb7f4d1ae1787fc01eba890481ccfab7790b22e

Download Submit
C:\Windows\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe

Filesize
168KB

MD5
b6cb6a7ebf2659d4aca3cb57d421945e

SHA1
f2813ae359fe098349d0b1fb6ef783b5eab30a58

SHA256
3f57f2aa4985d9341ac9be650b84b257cebf5ec46468b3d133296c99722b1acd

SHA512
2b0cd9df23da6b7b41d8270fa699db90cc81d2072e47f65a62c7bd0ff5b81a63a99b86d73c9f4f4ee89b6b65ef08a8244de51298cc3ba19294c02de1dc8646a4

Download Submit
C:\Windows\{F1E629F1-7FD3-4ba1-9B6E-1F34EF769452}.exe

Filesize
168KB

MD5
b6cb6a7ebf2659d4aca3cb57d421945e

SHA1
f2813ae359fe098349d0b1fb6ef783b5eab30a58

SHA256
3f57f2aa4985d9341ac9be650b84b257cebf5ec46468b3d133296c99722b1acd

SHA512
2b0cd9df23da6b7b41d8270fa699db90cc81d2072e47f65a62c7bd0ff5b81a63a99b86d73c9f4f4ee89b6b65ef08a8244de51298cc3ba19294c02de1dc8646a4

Download Submit
C:\Windows\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe

Filesize
168KB

MD5
927502cad019f2a9592b4191796c276b

SHA1
be1bcda1647647110ae405ba8f2d82b8d1a19eef

SHA256
9bdbc42c4bd3ba08fc89c9d1e2c4cccf480291f823c266594d495fa85dff9eb0

SHA512
7830ab932948fa1fe848c18f615badd90388a37c85298e46d76ac4b2d59619ae6738fec3df8564cee0318db88bd9edc9caf825deadb0a596bfed21347c5707dd

Download Submit
C:\Windows\{FA8A3301-8C84-49db-A843-8E66BB935F07}.exe

Filesize
168KB

MD5
927502cad019f2a9592b4191796c276b

SHA1
be1bcda1647647110ae405ba8f2d82b8d1a19eef

SHA256
9bdbc42c4bd3ba08fc89c9d1e2c4cccf480291f823c266594d495fa85dff9eb0

SHA512
7830ab932948fa1fe848c18f615badd90388a37c85298e46d76ac4b2d59619ae6738fec3df8564cee0318db88bd9edc9caf825deadb0a596bfed21347c5707dd

Download Submit